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Preface 


Although  it  has  not  suffered  a  successful  attack  since  the  July  7,  2005,  bombings  in  London, 
Europe  perceives  itself  to  be  under  a  constant  threat  from  jihadist-inspired  terrorism.  Based  on 
a  survey  of  legal  documents,  intelligence  reports,  academic  literature,  and  media  sources,  and 
on  conversations  with  experts  and  government  officials,  this  paper  provides  an  overview  of  cur¬ 
rent  trends  in  jihadism  in  Europe  from  an  operational  perspective. 

This  research  was  jointly  sponsored  by  the  Modeling  and  Simulation  Coordination  Office 
of  the  Office  of  the  Secretary  of  Defense/Cost  Assessment  and  Program  Evaluation,  the  Inter¬ 
agency  Task  Force  of  Special  Operations  Command,  and  the  Joint  Staff/J-8.  It  was  conducted 
within  the  International  Security  and  Defense  Policy  Center  of  the  RAND  National  Defense 
Research  Institute,  a  federally  funded  research  and  development  center  sponsored  by  the  Office 
of  the  Secretary  of  Defense,  the  Joint  Staff,  the  Unified  Combatant  Commands,  the  Navy,  the 
Marine  Corps,  the  defense  agencies,  and  the  defense  Intelligence  Community. 

For  more  information  on  the  International  Security  and  Defense  Policy  Center,  see 
http://www.rand.org/nsrd/ndri/centers/isdp.html  or  contact  the  director  (contact  information 
is  provided  on  the  web  page). 
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Summary 


Although  it  has  not  suffered  a  successful  attack  since  the  July  7,  2005,  bombings  in  London, 
Europe  perceives  itself  to  be  under  a  constant  threat  from  jihadist-inspired  terrorism.  Terror¬ 
ist  organizations  inspired  by  other  ideologies  are  still  active  throughout  the  European  Union, 
but  the  2010  Europol  annual  report  clearly  states  that  “Islamist  terrorism  is  still  perceived  as 
the  biggest  threat  to  most  Member  States,”  and  statements  from  the  highest-ranking  officials 
in  most  European  countries  confirm  this  observation.1  Authorities  base  their  assessment  on 
the  extensive  intelligence  and  investigative  activities  directed  against  jihadist  networks  taking 
place  in  virtually  every  European  country.  On  average,  in  fact,  European  authorities  arrest 
some  200  individuals  and  thwart  a  handful  of  plots  of  jihadist  inspiration  every  year.2  Keeping 
the  global  scenario  in  mind,  European  authorities  deem  this  dynamic  likely  to  continue  in  the 
foreseeable  future. 

Based  on  an  extensive  survey  of  indictments,  court  transcripts,  intelligence  reports,  aca¬ 
demic  literature,  and  media  sources,  and  on  conversations  with  experts  and  government  offi¬ 
cials  from  various  European  countries,  the  United  States,  and  a  handful  of  non-Western  coun¬ 
tries,  this  paper  seeks  to  provide  an  overview  of  the  current  trends  in  jihadism  in  Europe  from 
an  operational  perspective.  Its  main  finding  is  that  most  European  plots  appear  to  be  inde¬ 
pendent,  but  the  most-serious  ones  tend  to  have  extensive  operational  connections  to  groups 
operating  outside  of  Europe.  Moreover,  it  finds  that,  contrary  to  common  characterizations, 
there  is  little  evidence  indicating  that  al  Qaeda  and  affiliated  organizations  operating  outside 
of  Europe  conduct  direct  efforts  to  recruit  European  Muslims. 

For  the  most  part,  in  fact,  the  absorption  of  jihadist  ideology  by  European  Muslims  is  an 
independent  process,  taking  place  individually  or,  most  often,  with  a  small  group  of  friends. 
In  several  cases,  radical  preachers,  veterans  of  various  conflicts,  webmasters  of  radical  web¬ 
sites,  and,  more  generally,  charismatic  “jihad  entrepreneurs”  act  as  radicalizing  agents,  further 
exposing  already  sympathetic  individuals  to  jihadist  ideology.  Although  it  is  not  uncommon 
for  these  radicalizing  agents  to  possess  various  connections  to  al  Qaeda  and  affiliated  move¬ 
ments,  rarely  do  they  act  as  formal  al  Qaeda  agents  on  a  radicalizing  drive.  Similarly,  al  Qaeda 
and  affiliated  movements  do  regularly  issue  various  forms  of  communications  designed  to 
attract  European  Muslims.  However,  these  efforts  are  directed  to  the  masses,  and  there  is 
little  indication  of  direct  involvement  in  the  radicalization  of  individuals.  By  the  same  token, 


1  Europol,  2010,  p.  6. 

2  According  to  Europol  data,  European  countries  (excluding  the  United  Kingdom)  arrested  297  Islamist  terrorists  in 
2008-2009  (see  Europol,  2009,  2010).  The  United  Kingdom  does  not  differentiate  according  to  ideology  the  individuals 
it  arrests  for  terrorism-related  crime.  In  2008-2009  it  arrested  190  individuals  for  terrorism-related  crimes,  an  unspecified 
majority  of  whom  were  Islamists  (see  Home  Office,  2009). 
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the  cases  in  which  al  Qaeda  sent  members  to  Europe  to  recruit  new  affiliates  are  few  and  far 
between. 

A  significantly  more  common  occurrence  is  the  formation  of  a  linkage  between  self- 
radicalized  individuals  or  clusters  based  in  Europe  on  one  hand  and  al  Qaeda  and  like-minded 
groups  on  the  other,  with  the  former  reaching  out  to  the  latter.  Moreover,  based  on  an  analysis 
of  all  plots  against  Europe  between  2006  and  2010,  this  paper  shows  that  this  linkage  is  often 
the  element  that  determines  the  level  of  sophistication  of  the  plot.  Although  no  completely  suc¬ 
cessful  attack  has  been  registered  in  Europe  since  2005,  it  is  evident  that  attacks  planned  by 
individuals  and  networks  with  operational  ties  to  groups  operating  outside  of  Europe  tend  to 
be  more  elaborate,  professional,  and  potentially  lethal  than  those  hatched  by  individuals  and 
networks  who  operate  in  complete  independence.  Training  in  handling  explosives  received 
overseas  is,  in  most  cases,  the  factor  determining  this  difference.  The  paper  also  analyzes  other 
current  trends,  from  the  travel  destinations  of  aspiring  jihadists  to  the  growing  demographic 
diversity  of  Europe-based  networks. 


Acknowledgments 


Although  the  responsibility  for  the  views  expressed  in  this  paper  is  exclusively  mine,  I  have 
benefited  enormously  from  the  help  and  comments  of  various  friends  and  colleagues.  At  the 
RAND  Corporation,  I  would  like  to  thank  first  and  foremost  Todd  Helmus,  whose  help  was 
instrumental  in  conceiving  and  developing  this  project.  Special  mention  should  also  be  made 
of  Ambassador  James  Dobbins,  Nora  Bensahel,  Kim  Cragin,  Erin-Elizabeth  Johnson,  Jocelyn 
Lofstrom,  Mike  Lostumbo,  and  Joy  Merck.  Outside  of  RAND,  useful  feedback  was  provided 
by  Raffaello  Pantucci  and  Marc  Sageman.  I  would  also  like  to  thank  Javier  Jordan,  Alexander 
Klimburg,  Morten  Skjoldager,  and  handful  of  officials  in  several  countries  for  their  help  in 
clarifying  certain  details.  Finally,  I  am  particularly  indebted  to  the  paper’s  two  peer  reviewers, 
Peter  Neumann  and  Angel  Rabasa. 


XI 


CHAPTER  ONE 


The  Evolution  of  European  Jihadism 


The  first  logical  step  in  this  analysis  of  current  trends  in  jihadism  in  Europe  from  an  opera¬ 
tional  perspective  is  providing  a  brief  overview  of  the  evolution  of  European  jihadist  networks 
since  their  origin.  Scholars  have  developed  various  approaches  to  characterizing  this  evolution, 
but  the  presence  of  jihadist  networks  in  Europe  can  be  divided  into  four  phases:  the  establish¬ 
ment  phase,  the  globalized  phase,  the  homegrown  phase,  and,  finally,  the  linkage  phase.1  It 
must  be  noted  that  the  shifts  from  one  phase  to  another  are  not  always  clear-cut  and  that  they 
have  neither  taken  place  at  a  uniform  speed  throughout  Europe  nor  necessarily  erased  all  the 
elements  of  the  preceding  phase. 

The  first  phase  took  place  between  the  late  1980s  and  the  first  half  of  the  1990s,  as  a  few 
hundred  experienced  jihadist  militants  established  a  base  in  Europe.  Seeking  to  avoid  repres¬ 
sion  in  their  native  countries,  veterans  of  the  Afghan  jihad  against  the  Soviet  Union  and  mem¬ 
bers  of  various  militant  organizations  from  the  Middle  East  and  North  Africa  sought,  and  in 
most  cases  received,  political  asylum  in  several  European  countries.  Europe’s  freedoms,  the 
presence  of  large  diaspora  communities,  and  a  lack  of  attention  from  local  authorities  made 
Europe  an  ideal  logistical  base  from  which  militants  could  continue  their  activities.2  Such 
organizations  as  the  Egyptian  Gamaa  Islamiya  and  the  Algerian  Armed  Islamic  Group  created 
sophisticated  propaganda,  fundraising,  and  recruitment  networks  that  provided  crucial  sup¬ 
port  to  their  own  efforts  in  North  Africa.3 

This  first  phase  is  characterized  by  the  operational  separation  of  the  various  groups  operat¬ 
ing  in  Europe.  Although  they  all  shared  the  same  ideological  bases,  outfits  from  different  coun¬ 
tries  tended  to  maintain  a  certain  degree  of  autonomy  from  one  another.  Aside  from  isolated 
episodes,  in  fact,  coordination  among  them  tended  to  be  limited  to  statements  of  support  of 
their  brethrens’  cause.  Another  defining  operational  characteristic  of  the  networks  of  the  first 
phase  was  their  hierarchical  and  well-defined  structure.  Algerian,  Egyptian,  and  Tunisian  net¬ 
works,  arguably  the  three  most  extensive  networks  in  Europe  at  the  time,  were  organized  under 
a  strict  chain  of  command  whose  centralized  leadership  directed  a  well- compartmentalized 
structure  of  cells  in  all  aspects  of  their  activities.4  By  the  same  token,  roles  and  responsibilities 
within  each  cell  were  predefined  and  strictly  enforced.  Militants’  travels  outside  of  Europe  for 


1  Several  studies  outlining  different  yet  partially  overlapping  ways  to  categorize  the  various  phases  of  European  jihadism 
have  been  conducted  over  the  last  few  years.  See,  for  example,  Nesser,  2008a,  pp.  924-946;  Taarnby,  2005;  and  Vidino, 
2005. 

2  Vidino,  2005. 

3  Benjamin  and  Simon,  2002;  Botha,  2008,  Chapter  5. 

4  Neumann  and  Rogers,  2007,  pp.  23-26. 
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training  or  fighting  were  facilitated  by  well-established  support  networks  that  provided  docu¬ 
ments,  safe  houses,  and  smuggling  routes.5 

Finally,  it  is  noteworthy  that,  during  this  first  phase,  most  networks  showed  no  violent 
intent  toward  their  new  host  countries,  which  they  viewed  only  as  temporary  and  extremely 
convenient  bases  of  operations.  Although  it  was  apparent  from  their  sermons  and  propaganda 
that  European  jihadists  strongly  disapproved  of  Europe’s  liberal  moral  standards,  secularized 
societies,  foreign  policies,  and  perceived  anti-Muslim  biases,  they  tended  to  target  only  the 
regimes  of  their  countries  of  origin.  European  countries  were  spared  the  militants’  furor,  pro¬ 
vided  they  did  not  interfere  with  the  militants’  struggles  in  North  Africa  and  the  Middle  East. 
In  fact,  the  only  violent  acts  against  a  European  country  carried  out  during  this  phase  were  the 
series  of  attacks  that  bloodied  France  in  1994  and  1995,  a  campaign  orchestrated  by  Algerian 
militants  to  punish  the  French  government  for  its  support  of  the  Algerian  regime  during  the 
African  country’s  civil  war.6 

The  second  phase  of  jihadism  in  Europe  slowly  took  shape  during  the  second  half  of  the 
1990s.  By  1998,  Osama  Bin  Laden  and  Ayman  al  Zawahiri  had  perfected  al  Qaeda’s  reorga¬ 
nization  in  Afghanistan,  creating  a  global  platform  that  was  formalized  with  the  launch  of  the 
World  Islamic  Front  Against  Jews  and  Crusaders.7  Al  Qaeda’s  project  was  the  zenith  of  a  phe¬ 
nomenon  that  had  been  under  way  throughout  the  1990s  in  the  Afghan  training  camps;  on  the 
battlefields  of  Bosnia,  Chechnya,  and  Kashmir;  and  in  the  most-radical  mosques  of  a  handful 
of  European  cities.  Thanks  to  these  interactions,  various  jihadist  groups  operating  throughout 
Europe  began  increasingly  to  work  together,  their  cooperation  now  transcending  simple  moral 
support  and  becoming  operational. 

Moreover,  Bin  Laden  and  other  al  Qaeda  leaders  expressed  the  idea  that  the  best  strategy 
to  topple  secular  regimes  in  the  Muslim  world  was  to  end  the  economic  and  military  sup¬ 
port  these  regimes  received  from  the  United  States  and  other  Western  countries.8  Therefore, 
the  jihadist  movement  had  to  switch  its  emphasis  to  attacking  the  United  States  and  making 
a  continued  American  presence  in  the  Middle  East  too  painful  to  bear.  Al  Qaeda,  in  Bin 
Laden’s  mind,  was  to  become  the  umbrella  organization  for  jihadist  groups  from  through¬ 
out  the  Muslim  world;  united  under  its  banner,  all  would  fight  together  against  both  secular 
regimes  in  the  Muslim  world  and  their  protectors  in  the  West. 

The  result  of  these  two  developments  was  that,  by  the  end  of  the  1990s,  many  of  the 
networks  that  had  been  formed  throughout  Europe  had  fallen,  with  varying  degrees  of  alle¬ 
giance,  into  the  orbit  of  Bin  Laden’s  project.  Al  Qaeda  established  only  a  small  direct  presence 
in  Europe  and  for  the  most  part  co-opted  already  existing  networks,  particularly  the  Algerian 
ones.9  Because  of  their  familiarity  with  the  West,  Europe-based  militants  led  two  of  the  first 
operations  planned  by  the  jihadist  movement  against  the  American  homeland:  the  failed  Mil¬ 
lennium  bombing  of  the  Los  Angeles  International  Airport  in  2000  and  the  attacks  of  Sep¬ 
tember  11,  2001. 10 


5  Nesser,  2008b. 

6  Kepel,  2002,  pp.  8-13;  Lia  and  Kjok,  2001. 

7  The  9/11  Commission  Report,  2004,  pp.  63-70. 

8  The  9/11  Commission  Report,  p.  67. 

9  Gunaratna,  2002,  p.  114. 

10  United  States  v  Abu  Doha,  2001. 
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The  two  attacks  are  indicative  of  important  developments.  The  Millennium  bombing 
showed  that  a  network  that  was  still  heavily  involved  in  a  bloody  civil  war  in  its  country  of 
origin  (Algeria)  was  willing  to  put  its  forces  at  the  service  of  al  Qaeda’s  global  project,  signal¬ 
ing  a  clear  break  with  the  national  focus  maintained  by  jihadist  groups  in  the  past.11  By  the 
same  token,  the  core  9/11  hijackers,  having  radicalized  together  in  Hamburg,  represented  a 
clear  indication  that  Europe  was  home  to  small  clusters  of  militants  that,  although  unaffiliated 
with  any  organization  at  their  outset,  could  be  easily  co-opted  and  used  by  the  global  jihadist 
movement. 

Despite  these  shifts,  Europe  did  not  become  a  primary  target  of  jihadist  networks  during 
this  phase.  Algerian  networks  did  plan  some  attacks  in  Europe  during  the  second  phase,  but, 
aside  from  the  2000  plot  to  bomb  the  annual  Christmas  market  in  Strasbourg’s  Place  Kleber, 
most  of  them  did  not  mature  beyond  the  initial  stage.  Europe  was  home  to  a  growing  number 
of  militants,  many  of  whom,  unlike  the  pioneers  of  the  first  phase,  had  radicalized  in  Europe 
itself.  It  was  also  a  major  logistical  hub  for  various  jihadist  outfits,  and,  tellingly,  most  of  the 
attacks  perpetrated  by  al  Qaeda  at  the  time  had  at  least  some  link  to  Europe.  Yet,  Europe  itself 
remained  only  an  occasional  target. 

The  events  of  September  11,  2001,  caused  a  seismic  change  in  jihadist  networks  world¬ 
wide  and  launched  the  beginning  of  the  third  phase  in  Europe.  The  resulting  U.S.  invasion  of 
Afghanistan  brought  havoc  to  al  Qaeda’s  leadership.  Some  of  its  top  leaders,  including  those  in 
charge  of  coordinating  operations  throughout  the  world,  were  captured  or  killed.  Others  were 
driven  underground  and  rendered  unable  to  communicate  effectively.  The  Afghan  training 
camps  that  had  served  as  a  meeting  point  for  militants  from  all  over  the  world  were  bombed 
into  ashes.  The  loss  of  the  Afghan  sanctuary  was  a  major  blow  to  al  Qaeda,  which  became,  at 
least  temporarily,  unable  to  direct  the  activities  of  its  affiliated  networks  worldwide,  including 
in  Europe.12 

As  U.S.  forces  hunted  down  al  Qaeda  in  Afghanistan,  police  and  intelligence  agencies 
throughout  the  world  began  dismantling  networks  linked  to  the  organization.  This  global 
crackdown  further  reduced  the  ability  of  the  al  Qaeda  core  to  control  its  cells  and  affiliated 
groups  worldwide.  Arrests  were  particularly  numerous  in  Europe,  where  authorities  often 
moved  against  networks  they  had  been  monitoring  for  years.  At  least  two  plots  to  carry  out 
attacks  in  Europe  (one  in  Belgium  and  one  in  the  United  Kingdom)  were  uncovered  and 
thwarted  in  the  immediate  aftermath  of  9/11. 

Military  actions  in  Afghanistan  and  a  less  permissive  environment  in  Europe  rendered 
communications  between  al  Qaeda’s  leadership  and  networks  in  Europe  difficult.  Neither  was 
completely  annihilated  in  the  crackdown,  but  the  chaotic  situation  that  followed  the  loss  of 
the  Afghan  sanctuary  forced  Europe-based  jihadists  to  act  in  a  different  fashion.  Although  a 
certain  level  of  coordination  still  existed,  European  networks  began  to  operate  more  autono¬ 
mously,  remaining  loyal  to  al  Qaeda’s  ideology  and  goals  but  becoming  virtually  independent 
in  their  day-to-day  operations.13  As  Marc  Sageman  writes  in  his  influential  book  Leaderless 
Jihad, 


11  The  intensity  of  the  connectivity  between  Algerian  networks  operating  in  Europe  and  groups  operating  in  Algeria 
(whether  the  Salafist  Group  for  the  Preaching  and  Combat  at  the  time  of  the  Millennium  bombing  or  al  Qaeda  in  the 
Islamic  Maghreb  today)  is  widely  debated.  See,  for  example,  Marret,  2010,  p.  15. 

12  Hoffman,  2004,  pp.  551-552. 

13  Hoffman,  2004,  p.  552. 
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[t]he  present  threat  has  evolved  from  a  structured  group  of  al  Qaeda  masterminds,  control¬ 
ling  vast  resources  and  issuing  commands,  to  a  multitude  of  informal  local  groups  trying 
to  emulate  their  predecessors  by  conceiving  and  executing  operations  from  the  bottom 
up.  These  “homegrown”  wannabes  form  a  scattered  global  network,  a  leaderless  jihad.14 

If  outside  pressure  was  arguably  the  main  driver  behind  this  shift,  the  demographic  change 
taking  place  inside  European  jihadist  networks  also  played  a  crucial  role.  Small  numbers  of 
European-born  Muslims  had  joined  jihadist  networks  well  before  9/11,  but  the  vast  majority 
of  militants  operating  in  Europe  in  the  1980s  and  1990s  were  first-generation  immigrants. 
After  2001,  due  both  to  the  waves  of  arrests  and  deportations  that  targeted  the  first  generation 
of  militants  and  to  the  surge  in  numbers  of  European  Muslims  joining  jihadist  networks,  the 
trend  was  rapidly  reversed. 

Although  patterns  differ,  in  some  cases  quite  significantly,  from  country  to  country,  by 
2003,  many  European  authorities  began  to  witness  the  growth  of  small  clusters  of  home¬ 
grown  jihadist  networks.  A  quintessential  example  of  these  networks  is  the  so-called  Hofstad 
group,  the  loose  network  of  jihadists  that  came  to  life  in  late  2002  between  The  Hague  and 
Amsterdam.15  From  an  operational  perspective,  its  main  characteristics,  often  seen  in  similar 
networks,  were 

•  Lack  of  recruitment  and  self-radicalization.  In  the  1990s,  individuals  were  typically 
introduced  to  jihadist  ideology  through  personal  interactions  with  preachers  and  recruit¬ 
ers  in  such  places  as  prisons  and  radical  mosques.  In  most  cases,  an  older,  more  experi¬ 
enced  militant  guided  this  process  and  subsequently  inserted  the  new  adept  in  one  of  the 
network’s  compartmentalized  cells.  Although  a  more  senior,  self-styled  Syrian  preacher 
did  play  a  role  in  the  initial  formation  of  the  Hofstad  group,  this  process  was  largely 
absent  in  the  Hofstad  case  and  in  many  of  the  networks  that  had  appeared  throughout 
Europe  by  the  mid-2000s.  Individuals  tend  to  radicalize  independently,  often  through 
the  Internet,  or  in  small  groups  of  peers,  but  with  little  or  no  outside  intervention. 

•  Lack  of  hierarchy  and  structure.  Unlike  the  hierarchically  structured  cells  of  the  1990s, 
most  homegrown  networks  lack  the  clearly  dominant,  charismatic  figure  of  the  recruiter 
at  the  top  and,  in  consequence,  develop  a  more  egalitarian  spirit  in  their  internal  dynam¬ 
ics.  Members  who  are  most  knowledgeable,  most  faithful  in  attending  meetings,  and 
most  charismatic  naturally  stand  out,  but  they  do  not  generally  take  on  the  traditional 
role  of  a  leader.  In  the  absence  of  a  formal  structure,  every  member  is  free  to  act  on  his 
own,  without  awaiting  the  direction  of  some  superior.  More  closely  resembling  street 
gangs  than  the  jihadist  groups  of  the  1990s,  homegrown  clusters  do  not  have  a  clear  divi¬ 
sion  of  roles  or  a  compartmentalized  structure.  It  is  telling  that,  in  the  case  of  the  Hofstad 
group,  apparently  no  other  member  of  the  network  was  aware  that  Mohammed  Bouyeri, 
one  of  Hofstad ’s  key  members,  had  planned  to  assassinate  Dutch  filmmaker  Theo  van 
Gogh. 

•  Lack  of  ties  to  external  organizations.  The  homegrown  clusters  that  have  appeared 
throughout  Europe  since  the  mid-2000s  often  lack  any  connection  to  al  Qaeda  or  any 
other  outfit.  Although  some  occasionally  manage  to  link  up  with  external  forces,  these 


14  Sageman,  2008,  p.  vii. 

15  Vidino,  2007. 
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connections  seldom  have  implications  at  the  operational  level.  From  day-to-day  logisti¬ 
cal  operations  to  planning  attacks,  homegrown  clusters  operate  independently.  Although 
they  perceive  themselves  as  part  of  a  global  movement  and  share  all  aspects  of  jihadist 
ideology,  such  clusters  as  the  Hofstad  group  possess  no  operational  ties  to  al  Qaeda  or  its 
affiliated  movements. 

•  Increased  focus  on  domestic  issues  and  targets.  Although  such  global  events  as  the 
wars  in  Iraq  and  Afghanistan  and  the  Israeli-Palestinian  conflict  unquestionably  con¬ 
tribute  to  the  radicalization  of  the  new  generation  of  European  jihadists,  events  that  take 
place  in  Europe — such  as  the  Danish  cartoon  controversies — and  the  foreign  policies  of 
individual  countries  play  an  increasingly  important  role  in  the  process.  As  the  motives 
for  European  jihadists’  radicalization  have  become  increasingly  domestic,  so  have  their 
targets.16  The  Algemene  Inlichtingen-  en  Veiligheidsdienst  (AIVD),  the  Netherlands’ 
domestic  intelligence  agency,  describes  this  new  phenomenon  as  “European  jihad,”  a  new 
phase  of  jihadism  in  which  the  key  actors  are  “European  Muslims  who  are  prepared  to 
commit  attacks  in  their  own  country”  and  are  motivated  primarily  by  domestic  issues.17 
As  homegrown  networks  began  planning  attacks  in  several  countries,  Europe  shifted 
from  occasional  to  frequent  terrorist  target.  The  consequence  of  the  lack  of  ties  to  exter¬ 
nal  organizations  was  that  most  of  the  attack  attempts  were  highly  amateurish.  Devoid 
of  the  operational  knowhow  their  predecessors  had  obtained  in  the  training  camps  of 
Afghanistan,  homegrown  jihadists  either  failed  in  their  attempts  or  conducted  extremely 
unsophisticated  attacks. 

The  growth  of  homegrown  networks  does  not  mean  that  the  traditional  model  of  the 
1990s  has  been  completely  supplanted.  Rather,  the  current  panorama  of  jihadist  networks  in 
Europe  is  an  extremely  diverse  one  and  can  be  visualized  as  a  continuum.  At  one  extreme,  we 
find  homegrown  groups  a  la  Hofstad:  small  clusters  of  mostly  European-born  radicals  with  no 
ties  to  external  groups  and  that  act  with  absolute  operational  independence.  At  the  opposite 
end  of  the  spectrum,  we  see  compartmentalized  cells  contained  in  a  well-structured  network 
and  subjected  to  a  hierarchical  structure,  as  was  the  model  of  jihadist  groups  operating  in 
Europe  in  the  1990s. 

Between  these  two  extremes  is  a  whole  spectrum  of  realities,  positioned  according  to  the 
level  of  autonomy  of  the  group.  The  most  common  model  seems  to  be  that  of  the  July  7,  2005, 
London  bombers:  a  small  group  of  young  men,  most  of  whom  were  born  and  raised  in  Europe, 
who  know  each  other  either  from  the  mosque  or  from  the  neighborhood  and  become  radical¬ 
ized  in  Europe.18  Some  of  these  locally  groomed  jihadist  “wannabes”  travel  abroad  to  gain  from 
various  al  Qaeda-affiliated  groups  the  necessary  bomb-making  expertise  that  will  allow  the 
group  to  jump  from  an  amateurish  cluster  of  friends  to  a  full-fledged  terrorist  cell. 

The  presence  of  a  linkage  between  homegrown  networks  and  al  Qaeda  and  affiliated 
movements  (AQAM)  characterizes  the  fourth  and  current  phase  of  jihadism  in  Europe.  The  line 
between  Europe  and  AQAM  was  never  completely  broken,  even  in  the  immediate  aftermath 
of  9/11.  Europe-based  North  African  networks,  both  homegrown  and  traditional,  retained  ties 


16  See  Crone  and  Harrow,  2010. 

17  Algemene  Inlichtingen-  en  Veiligheidsdienst,  2006,  p.  7. 

18  House  of  Commons,  2006,  pp.  13—21. 
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to  Algerian  and  Moroccan  groups  throughout  the  early  2000s.  And,  even  in  the  immediate 
aftermath  of  9/11,  UK-based  homegrown  clusters  consistently  managed  to  retain  or  establish 
ties  to  AQAM  in  Pakistan.19  These  ties,  often  built  through  the  family  connections  of  many 
British  Muslims  of  Pakistani  descent,  allowed  British  jihadists  to  acquire  a  level  of  expertise 
vastly  superior  to  that  of  their  continental  European  counterparts.  Therefore,  not  surprisingly, 
by  the  mid-2000s,  not  only  was  the  United  Kingdom  the  most  frequently  targeted  country,  but 
several  plots  against  it  were  significantly  more  sophisticated  than  the  plots  hatched  by  home¬ 
grown  networks  in  the  rest  of  Europe. 

Yet,  by  the  second  half  of  the  2000s,  the  pattern  witnessed  by  British  authorities  began  to 
be  observed  by  their  counterparts  throughout  Europe.  In  its  2008  annual  report,  Europol  tell¬ 
ingly  stated  that  “the  foiled  attacks  in  Germany  and  Denmark  in  2007  demonstrated  that  con¬ 
tacts  between  networks  in  the  EU  and  al-Qaeda-affiliated  groups  in  the  Pakistan-Afghanistan 
region  are  not  a  problem  for  the  UK  alone.”20  Homegrown  clusters  throughout  Europe  slowly 
managed  to  establish  links  to  AQAM,  traveling  outside  of  Europe  to  obtain  training  and 
operational  guidance.  Because  few  established  such  ties  through  family  connections,  as  British 
jihadists  did,  many  succeeded  in  linking  up  with  AQAM  in  other  ways,  including  through  the 
Internet.  Linkages  were  established  not  just  with  al  Qaeda  and  affiliated  groups  in  Pakistan  but 
also  with  al  Qaeda  offshoots  in  Yemen  and  Somalia. 

This  fourth  phase  of  jihadism  in  Europe  is  arguably  the  most  complex,  characterized  by 
the  lack  of  uniformity  in  the  attributes  of  the  networks  operating  on  the  ground.  Although 
the  pioneers  of  the  first  phase  have  virtually  disappeared,  networks  with  characteristics  typi¬ 
cal  of  the  second  and  third  phases  are  very  much  present.  The  novelty  of  the  fourth  phase  is 
the  increased  frequency  of  the  linkage  between  homegrown  networks  from  several  European 
countries  on  one  hand  and  AQAM  on  the  other.  The  next  chapter  describes  the  operational 
impact  of  this  linkage. 


19  Sageman,  2007. 

20  Europol,  2008. 


CHAPTER  TWO 


Linkage  as  the  Key 


To  understand  the  recent  dynamics  of  jihadism  in  Europe,  it  is  necessary  to  clarify  the  differ¬ 
ence  between  three  separate,  albeit  interconnected,  phenomena:  radicalization,  recruitment, 
and  linkage.  Although  various  scholars  and  institutions  adopt  different  definitions,  radicaliza¬ 
tion  can  be  described,  in  the  words  of  Charles  Allen,  as  “the  process  of  adopting  an  extremist 
belief  system,  including  the  willingness  to  use,  support,  or  facilitate  violence,  as  a  method  to 
effect  societal  change.”1  Over  the  last  few  years,  scholars  and  policymakers  have  devoted  sig¬ 
nificant  attention  to  understanding  the  reasons  why  individuals  radicalize,  often  achieving 
scarce  results.  Radicalization  is  a  complex  and  highly  individualized  process  determined  by 
the  interaction  of  various  structural  and  individual  factors,  and  it  is  therefore  very  difficult  to 
exactly  capture  in  all  its  dynamics.  From  an  operational  point  of  view,  it  is  nevertheless  pos¬ 
sible  to  observe  that,  in  the  case  of  the  vast  majority  of  European  Muslims  who  join  jihadist 
networks,  radicalization  is  a  bottom-up  process. 

Studies  by  Sageman  have  convincingly  demonstrated  that  the  popular  image  of  a  ter¬ 
rorist  recruiter  “lurking  in  mosques,  ready  to  subvert  naive  and  passive  worshippers”  does  not 
describe  reality,  particularly  in  Western  Europe.2  A  top-down  process  in  which  a  member  of  a 
jihadist  group  seeks  out  a  potential  recruit,  introduces  him  to  jihadist  ideology,  grooms  him, 
and  eventually  inserts  him  into  the  group  is  a  highly  uncommon  phenomenon.  A  similar  pat¬ 
tern  was  more  common  in  some  of  the  North  African  networks  of  the  1990s,  where  individuals 
were  often  introduced  by  relatives  or  friends  to  midranking  members  of  jihadist  groups  who 
oversaw  the  entire  radicalization  process  from  the  beginning.3  There  are  reports  that  members 
of  al  Shabaab,  the  Somali  al  Qaeda  affiliate,  approach  nonradicalized  individuals  in  Europe 
with  the  idea  of  grooming  them  and  eventually  enlisting  them  in  the  group.4 

For  the  most  part,  however,  the  absorption  of  jihadist  ideology  by  European  Muslims  is 
an  independent  process,  taking  place  individually  or  with  a  small  group  of  friends.  In  several 
cases,  radical  preachers,  veterans  of  various  conflicts,  webmasters  of  radical  websites,  and,  more 
generally,  charismatic  “jihad  entrepreneurs”  act  as  radicalizing  agents,  further  exposing  already 
sympathetic  individuals  to  jihadist  ideology.  Although  it  is  not  uncommon  for  these  radical¬ 
izing  agents  to  possess  various  connections  to  AQAM,  rarely  do  they  act  as  formal  al  Qaeda 
agents  on  a  radicalizing  drive.  By  the  same  token,  there  is  no  question  that  websites  and  other 


1  Allen,  2007. 

2  Sageman,  2004,  p.  122. 

3  Nesser,  2009,  p.  89. 

4  Interviews  with  various  European  intelligence  officials  (The  Hague  and  Brussels,  December  2009;  Paris,  February  2010; 
and  London,  April  2010). 
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forms  of  propaganda  created  by  AQAM  serve  the  purpose  of  radicalizing  European  Muslims. 
However,  these  efforts  are  directed  to  the  masses,  and  there  are  few  indications  of  direct,  face- 
to-face  involvement  of  AQAM  in  the  radicalization  of  individuals. 

If  radicalization  is  largely  a  bottom-up  process,  so  is  a  closely  related  phenomenon:  recruit¬ 
ment.  Recruitment  is  the  process  through  which  a  terrorist  group  inserts  an  already  radical¬ 
ized  individual  into  its  ranks.5  In  the  case  of  many  terrorist  organizations  outside  of  Europe, 
from  Hamas  to  the  Liberation  Tigers  of  Tamil  Eelam,  it  is  fair  to  speak  of  a  top-down  effort, 
where  members  of  the  group  act  as  enlistment  officers,  scouring  schools,  social  clubs,  and  other 
venues  for  new  militants.6  A1  Qaeda-affiliated  groups  act  in  a  similar  manner  in  various  parts 
of  the  world,  from  Somalia  to  the  Philippines.  But,  in  Europe,  the  dynamics  are  quite  different. 
Although  some  exceptions  do  exist  (Europe-based  al  Shabaab  support  networks,  for  example, 
reportedly  conduct  what  can  be  properly  considered  recruitment  efforts),  there  is  little  evidence 
of  a  concerted  effort  by  AQAM  to  recruit  already  radicalized  European  Muslims.  Contrary 
to  public  perceptions,  there  are  few  indications  of  a  consistent  top-down  effort  by  AQAM  to 
attract  and  recruit  new  militants  on  the  Old  Continent  by  deploying  recruiters  to  spot  new 
talent  on  the  ground. 

What  is  instead  a  significantly  more  common  occurrence  is  the  linkage  between  the  already 
radicalized  individual  or  cluster  in  Europe  and  AQAM.  And,  in  the  vast  majority  of  cases,  this 
linkage  is  initiated  by  the  individual  or  cluster  rather  than  by  AQAM.  If  any  form  of  loosely 
defined  recruitment  exists,  it  is  because  the  “applicant”  reached  out  to  the  “employer,”  and  not 
the  other  way  around.  Limiting  its  assessment  to  the  Netherlands  but  incidentally  describing  a 
trend  seen  throughout  Europe,  in  2010,  the  AIYD  stated  that  “contacts  between  active  jihadist 
networks  or  individuals  here  and  long-established  transnational  networks  elsewhere”  are  estab¬ 
lished  in  various  ways.  But,  added  the  Dutch  intelligence  agency,  “the  initiative  for  first  con¬ 
tact  usually  seems  to  come  from  the  Dutch  side;  there  appears  to  exist  no  planned  recruitment 
strategy  on  the  part  of  the  transnational  networks  concerned.”7  Aside  from  limited  exceptions, 
recruitment  in  Western  Europe  exists  not  as  a  traditional,  top-down  phenomenon  but  rather 
only  in  the  sense  of  a  bottom-up  process  that  is  better  defined  as  linkage. 


5  Gerwehr  and  Daly,  2006,  pp.  73-87. 

6  Helmus,  2009,  p.  77. 

Algemene  Inlichtingen-  en  Veiligheidsdienst,  2010,  p.  6. 
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CHAPTER  THREE 


Analysis  of  Case  Studies 


Although  the  abovementioned  dynamics  of  radicalization,  recruitment,  and  linkage  are  at  play 
in  all  sorts  of  jihadist  activities,  including  fundraising,  propaganda,  and  traveling  overseas  for 
training  or  fighting,  they  become  particularly  relevant  in  the  actual  planning  of  terror  attacks. 
The  author  therefore  decided  to  create  a  database  listing  all  plots  against  targets  inside  the 
European  Union  from  January  1,  2006,  to  December  31,  2010,  and  to  analyze  their  charac¬ 
teristics  and  level  of  connectivity  with  AQAM  (see  Table  3.1  at  the  end  of  this  chapter).  Before 
outlining  the  evidence  derived  from  the  database,  it  is  necessary  to  explain  the  methodology 
employed  in  creating  it. 

In  the  database,  incidents  are  considered  plots  and  are  therefore  included  when  they 
involve  the  case  of  an  individual  or  a  network  that  executed,  attempted  to  execute,  or  con¬ 
cretely  planned  to  execute  an  act  of  violence  motivated  by  jihadist  ideology.  The  first  two 
instances  are  inherently  easier  to  identify;  the  third  can  require  difficult  and  subjective  choices. 
Therefore,  a  plot  is  deemed  to  have  been  planned  either  when  authorities  possessed  concrete 
evidence  pointing  to  some  concrete  plan  being  hatched,  irrespective  of  whether  explosives  and 
weapons  were  found  in  connection  with  it,  or  when  there  were  no  known  plans  but  an  indi¬ 
vidual  or  group  was  found  in  possession  of  weapons  or  explosives  and  there  was  clear  evidence 
that  those  involved  embraced  jihadist  ideology  and  expressed  violent  views. 

Adopting  this  admittedly  broad  definition  of  plot,  the  author  of  the  database  decided  to 
include  some  “borderline”  cases.  First,  irrespective  of  each  country’s  relevant  legal  definitions, 
which  can  differ  tremendously,  the  author  decided  to  include  the  cases  of  individuals  or  clus¬ 
ters  that  clearly  embraced  jihadist  ideology  and  were  found  with  explosives.  In  many  of  these 
cases,  authorities  were  not  certain  of  the  target  or  whether  a  plot  was  actually  in  the  making 
but  could  only  make  an  informed  assumption  that,  given  the  suspects’  ideology  and  the  pres¬ 
ence  of  explosives,  some  attack  was  likely  being  contemplated. 

Second,  cases  that  were  not  officially  considered  acts  of  terrorism  by  courts  are  included 
if  they  meet  the  abovementioned  requirements.  The  2006  shooting  of  an  Oslo  synagogue  by 
a  known  jihadist  sympathizer,  for  example,  was  considered  simply  an  act  of  vandalism  by  a 
Norwegian  judge  (although  prosecutors  had  attempted  to  qualify  it  as  an  act  of  terror).  Because 
legal  definitions  vary  from  country  to  country,  acts  of  violence  motivated  by  jihadist  ideology 
are  included  irrespective  of  the  legal  developments  of  the  case. 

Third,  the  database  includes  cases  in  which  individuals  involved  in  an  alleged  plot  were 
acquitted  or  not  prosecuted,  if  it  is  clear  that  this  outcome  was  due  to  legal  reasons  (such  as 
the  impossibility  of  introducing  key  evidence  during  the  trial)  and  if  authorities  stood  by  their 
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claim  that  a  plot  was  in  the  making.  This  was  the  case,  for  example,  in  the  2009  arrest  of  two 
clusters  in  Manchester  and  Liverpool  with  alleged  links  to  al  Qaeda.1 

Although  a  broad  definition  of  plot  was  adopted,  not  included  in  the  database  are 

•  cases  in  which  an  individual  or  a  group  made  threats,  in  some  cases  quite  specific,  about 
a  terror  attack,  if  no  evidence  was  uncovered  to  substantiate  that  any  concrete  planning 
existed.  Even  cases  in  which  individuals  were  convicted  for  “making  terrorist  threats”  are 
not  included.2 

•  cases  that  authorities  initially  considered  or  suspected  to  be  terrorist  plots  but,  after  closer 
scrutiny,  were  deemed  not  to  be.  That  was  the  case,  for  example,  in  the  dismantling  of 
the  Brussels-based  network  led  by  Malika  El  Aroud  and  Moez  Garsallaoui  by  Belgian 
authorities  in  December  2008.  Initially  suspected  of  planning  a  suicide  attack,  possibly 
against  the  European  Union  summit,  the  members  of  the  network  were  later  charged  and 
convicted  only  of  recruiting  for  a  terrorist  organization.  Because  no  evidence  of  any  con¬ 
crete  plan  for  an  attack  was  found,  and  because  the  charge  was  dropped  by  prosecutors 
during  the  trial,  the  case  is  not  included  in  the  database. 

•  cases  that  might  well  have  been  terror  plots  in  the  making  but  for  which  little  or  no 
evidence  is  publicly  available.  That  was  the  case,  for  example,  in  the  October  2010  plot, 
allegedly  linked  to  al  Qaeda,  to  execute  Mumbai-style  attacks  in  various  European  capi¬ 
tals.  Although  the  plot  was  likely  real,  there  are  no  publicly  available  indications  that 
associated  arrests  were  made  in  Europe,  and  all  the  information  about  it  is  vague  or  highly 
classified. 

•  instances  in  which  there  is  no  concrete  evidence  of  a  jihadist  link.  That  was  the  case,  for 
example,  in  the  discovery  of  the  five  sticks  of  dynamite  placed  outside  the  Le  Printemps 
department  store  in  Paris  in  December  2008,  allegedly  by  a  group  calling  itself  the  Afghan 
Revolutionary  Front.  Various  aspects  of  the  case  raise  serious  doubts  about  the  group’s 
authenticity  and  motives.3 

•  plots  planned  inside  the  European  Union  but  to  be  executed  outside  it.  Plots  targeting 
flights  directed  to  or  originating  from  Europe  are,  on  the  other  hand,  included  in  the 
database. 

•  cases  in  which  individuals  talked  about  possible  attacks  but  there  is  no  evidence  of  any 
concrete  preparation  for  them.  That  was  the  case,  for  example,  in  the  October  2009  arrest 
of  two  French  brothers  who  discussed  potential  targets  for  attacks  in  France  among  them¬ 
selves  and  with  members  of  al  Qaeda  in  the  Islamic  Maghreb  (AQIM)  online.  Because 


1  For  an  overview  of  this  counterterrorism  operation,  known  as  Operation  Pathway,  see  Carlisle,  2009.  It  is  also  telling 
that  the  United  States  has  sought  the  extradition  of  Abid  Naseer,  the  alleged  ringleader  of  the  Pathway  network. 

2  That  was  the  case,  for  example,  in  the  2008  conviction  of  Saeede  Ghafoor,  a  British  Muslim,  for  making  threats  to  blow 
up  a  shopping  center  in  England.  Because  no  explosives  and  no  concrete  plans  were  found,  and  because  there  are  other  indi¬ 
cations  that  Ghafoor’s  plan  was  more  than  haphazard  (for  example,  Ghafoor  told  a  prison  guard  that  he  planned  to  bomb 
the  Bluewater  shopping  center  in  Exeter  and,  when  the  guard  pointed  out  that  the  center  was  actually  in  Kent,  responded 
that  “the  plan  is  not  finalised  yet”),  the  incident  was  not  included.  See  Crown  Prosecution  Service,  undated-a,  and  “Man 
Admits  Bluewater  Bomb  Threat,”  2008. 

3  “Explosifs  au  Printemps,”  2008. 
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French  authorities  stated  that  the  men  had  “not  committed  material  preparatory  acts,”  the 
incident  is  not  included.4 

•  cases  of  training  for  terrorist  purposes,  whether  conducted  inside  or  outside  the  European 
Union 

•  cases  against  individuals  found  in  possession  of  manuals  and  other  writings  to  fabricate 
explosives,  if  no  explosives  or  concrete  plans  for  attacks  were  also  found 

•  a  handful  of  potential  cases  that  developed  at  the  end  of  2010.  During  the  last  two 
months  of  2010,  authorities  in  several  European  countries  claimed  to  have  thwarted  vari¬ 
ous  unrelated  plots.  Given  the  recency  of  the  cases  and  the  paucity  of  details  revealed  by 
authorities,  the  author  has  been  unable  to  verify  the  specifics  of  these  claims.  For  some 
of  them,  such  as  alleged  plots  that  led  to  arrests  in  France,5  Sweden,6  Belgium,7  and  the 
Netherlands,8  it  was  difficult  at  the  time  of  writing  to  know  whether  a  plot  was  indeed 
in  the  making.  Fewer  or  no  doubts  exist  that  three  instances  that  took  place  in  Decem¬ 
ber  2010 — the  Stockholm  suicide  bombing,9  the  arrest  of  12  militants  in  Wales  and 
England,10  and  the  joint  Danish-Swedish  operation  against  a  cluster  allegedly  targeting 
the  Jyllands-Posten  building  in  central  Copenhagen11 — were  indeed  plots.  These  latter 
cases  are  therefore  included  in  the  database,  but,  because  doing  so  would  be  premature, 
no  determination  has  been  made  concerning  the  existence  of  links  between  the  plotters 
and  AQAM. 


4  Samuel,  2009. 

5  In  November  2010,  French  authorities  arrested  five  men  who  they  claimed  were  planning  attacks  inside  the  country. 
French  Interior  Minister  Brice  Hortefeux  went  so  far  as  to  state  that  “one  of  the  five  said  they  were  ready  to  die  for  the  cause” 
(Vinocur,  2010).  Few  details  have  been  provided,  and  it  is  impossible  to  verify  details  of  the  case  at  this  time. 

6  In  November  2010,  authorities  in  Gothenburg  arrested  several  men  allegedly  involved  in  a  plot  against  a  local  shopping 
center.  Few  details  have  been  provided,  and  it  is  impossible  to  verify  details  of  the  case  at  this  time. 

7  In  November  2010,  Belgian  authorities  led  an  operation  with  ramifications  in  the  Netherlands,  Germany,  and  Austria 
against  a  network  that  was  allegedly  planning  attacks,  possibly  in  the  Antwerp  area.  Few  details  have  been  provided,  and  it 
is  impossible  to  verify  details  of  the  case  at  this  time. 

8  In  December  2010,  Dutch  authorities  arrested  12  men  of  Somali  origin  in  the  Rotterdam  area,  accusing  them  of  plan¬ 
ning  attacks  in  the  Netherlands.  Within  a  week,  all  arrestees  were  released,  although  authorities  still  consider  some  of  them 
suspects.  Few  details  have  been  provided,  and  it  is  impossible  to  verify  details  of  the  case  at  this  time. 

9  On  December  11,  2010,  Taimour  Abdulwahab  al  Abdaly,  an  Iraqi-born  Swede  and  longtime  resident  of  Luton,  died 
when  one  of  the  six  pipe  bombs  he  was  carrying  exploded  in  a  central  Stockholm  street.  Although  the  dynamic  is  still 
unclear,  it  seems  that  al  Abdaly,  whose  vehicle  exploded  a  few  seconds  before  the  pipe  bombs,  was  trying  to  reach  the  target 
of  his  alleged  suicide  attack  when  the  explosives  went  off  prematurely.  Although  this  was  obviously  a  terrorist  attack,  and 
although  a  suspected  accomplice  has  been  arrested  in  Scotland,  it  is  unclear  at  this  point  whether  al  Abdaly  acted  indepen¬ 
dently  or  had  operational  connections  to  external  actors. 

10  In  December  2010,  British  authorities  arrested  12  suspects  in  Cardiff,  London,  Birmingham,  and  Stoke-on-Trent,  accus¬ 
ing  them  of  planning  attacks  against  various  targets  throughout  central  London.  Although  it  is  apparent  that  a  plot  was 
indeed  in  the  making,  it  is  unclear  at  this  point  whether  the  men  were  acting  independently  or  had  operational  connections 
to  external  actors. 

11  In  December  2010,  Danish  and  Swedish  authorities  arrested  five  men  in  Copenhagen  and  Stockholm,  accusing  them  of 
planning  a  Mumbai-style  attack  against  the  Copenhagen  offices  of  Jyllands-Posten.  Although  it  seems  apparent  that  a  plot 
was  indeed  in  the  making,  it  is  unclear  at  this  point  whether  the  men  were  acting  independently  or  had  operational  connec¬ 
tions  to  external  actors. 
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There  are  inherent  and  unavoidable  flaws  and  limitations  involved  in  compiling  a  data¬ 
base  of  terrorist  plots.  Some  have  to  do  with  sources  and  the  completeness  of  information. 
Having  to  rely  mostly  on  open  sources  inevitably  provides  only  a  partial  knowledge  of  each 
case.  In  most  cases,  a  wealth  of  information  was  available,  including  court  documents,  intel¬ 
ligence  reports,  media  reporting,  and  interviews  with  officials.  In  other  cases,  only  newspaper 
clippings  were  available.  In  some  cases,  extensive  information  detailing  the  characteristics  of 
the  plot  and  the  individuals  involved  in  it  were  not  available  even  to  authorities  themselves.  It 
is  therefore  not  unlikely  that  an  incident  categorized  as  independent  was,  in  reality,  not  inde¬ 
pendent  and  that  links  between  the  plotters  and  AQAM  have  not  yet  been  uncovered.  The 
opposite  is  also  feasible,  as  a  complete  knowledge  of  the  dynamics  of  a  case  could  show  that 
such  links,  in  reality,  did  not  exist.  Moreover,  there  is  an  obvious  element  of  arbitrariness  in 
categorizing  plots  one  way  or  the  other  and  even  in  deciding  whether  a  certain  incident  con¬ 
stitutes  or  involved  a  plot.  Some  cases  are  unquestionably  borderline,  and  the  author  does  not 
seek  to  be  categorical  in  his  decisions,  admitting  that  it  would  not  be  unreasonable  to  define 
some  incidents  differently. 


Table  3.1 

Plots  Against  Targets  Inside  the  European  Union  from  January  1,  2006,  to  December  31,  2010 


Date 

Name 

Country 

Target 

Outcome 

Type 

March  2006 

San  Petronio  plot 

Italy 

Church  in 

Bologna 

Attackers  arrested 

Hybrid 

July  2006 

Cologne  train 
bombings 

Germany 

Two  regional 
trains 

Bombs  failed  to 
detonate 

Independent 

August  2006 

Transatlantic  plot 
(Overt) 

United  Kingdom 

Transatlantic 

airliners 

Attackers  arrested 

Hybrid 

September  2006 

Vollsmose  case 

Denmark 

Targets  in 
Denmark 

Attackers  arrested 

Independent 

September  2006 

Oslo  synagogue 
shooting 

Norway 

Oslo  synagogue 

Shots  fired  at  night, 
no  victims 

Independent 

December  2006 

Operacion  Duna 

Spain 

Possibly  targets 
in  Ceuta 

Attackers  arrested 

Independent 

January  2007 

Beheading  plot 
(Gamble) 

United  Kingdom 

Beheading  a 
soldier 

Attackers  arrested 

Independent 

May  2007 

Kamel  Bouchentouf 

France 

Targets  in  France 
and  Luxemburg 

Attacker  arrested 

Independent 

June  2007 

Doctors'  plot 

United  Kingdom 

Nightclub  in 

London/Glasgow 

airport 

Bombs  failed  to 
detonate;  only  the 
attacker  was  injured 

Independent 

September  2007 

Glasvej  case 

Denmark 

Possible  targets 
in  Copenhagen 

Attackers  arrested 

Hybrid 

September  2007 

Operation  Alberich/ 
Sauerland  plot 

Germany 

Club  and  military 
bases  in  Germany 

Attackers  arrested 

Hybrid 

December  2007 

Hassan  Tabbakh 

United  Kingdom 

Unknown 

Attacker  arrested 

Independent 

January  2008 

Operacion  Cantata 

Spain 

Barcelona  metro 

Attackers  arrested 

Hybrid 

April  2008 

Andrew  Ibrahim 

United  Kingdom 

Shopping  center 
in  Bristol 

Attacker  arrested 

Independent 
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Table  3.1 — Continued 


Date 

Name 

Country 

Target 

Outcome 

Type 

May  2008 

Nick  Reilly 

United  Kingdom 

Restaurant  in 
Exeter 

Only  the  attacker 
was  injured 

Independent 

June  2008 

Nicholas  Roddis 

United  Kingdom 

Unknown 

Attacker  arrested 

Independent 

August  2008 

Krenar  Lusha 

United  Kingdom 

Unknown 

Attacker  arrested 

Independent 

September  2008 

Jewel  of  Medina 
plot 

United  Kingdom 

Publisher  in 
London 

Attackers  arrested 

Independent 

December  2008 

Macherio  plot 

Italy 

Various  targets  in 
the  Milan  area 

Attackers  arrested 

Independent 

December  2008 

Rany  Arnaud 

France 

Direction  de 
la  Surveillance 
du  Territoire 
headquarters  in 
Levallois-Perret 

Attacker  arrested 

Independent 

April  2009 

Operation  Pathway 

United  Kingdom 

Possible  targets 
in  Manchester 

Attackers  arrested 

Hybrid 

October  2009 

Santa  Barbara 
bombing 

Italy 

Military  barracks 
in  Milan 

Only  the  attacker 
was  injured 

Independent 

October  2009 

Mickey  Mouse 
Project/Headley  case 

Denmark 

Targets  in 
Copenhagen 

Attacker  arrested 

External 

December  2009 

Christmas  bombing 

Holland 

Transatlantic 

airliner 

Bomb  failed  to 
detonate 

Hybrid 

December  2009 

Muhidin  Gelle 

Denmark 

Danish  cartoonist 
Kurt 

Westergaard 

Only  the  attacker 
was  injured 

Independent 

February  2010 

Rajib  Karim/British 
Airways  plot 

United  Kingdom 

British  Airways 
plane 

Attacker  arrested 

Independent 

March  2010 

Lars  Vilks  plot 

Ireland/ 

Sweden 

Swedish 

cartoonist 

Lars  Vilks 

Attackers  arrested 

Independent 

May  2010 

Roshonara  Choudhry 

United  Kingdom 

British  Member 
of  Parliament 
Stephen  Timms 

Timms  was  stabbed 

Independent 

August  2010 

Lors  Dukayev 

Denmark 

Jyllands-Posten 

building 

Only  the  attacker 
was  injured 

Independent 

September  2010 

Oslo  plot 

Norway 

Possible  Chinese 
targets  in  Oslo 

Attackers  arrested 

Hybrid 

December  2010 

Stockholm 
suicide  bombing 

Sweden 

Unclear,  but 
possible  targets 
within  central 
Stockholm 

Bombs  were 

detonated 

prematurely 

Unclear 

December  2010 

London  plot 

United  Kingdom 

Possible  targets 
throughout 
central  London 

Attackers  arrested 

Unclear 

December  2010 

Jyllands-Posten 
plot  (Brandbergen 
network) 

Denmark 

Jyllands-Posten 
building  in 
Copenhagen 

Attackers  arrested 

Unclear 

NOTE:  The  plot  names  used  in  this  table  are  the  names  most  commonly  used  in  terrorism  circles.  Some  are  derived 
from  the  plot's  targets,  some  from  associated  counterterrorism  operations,  and  some  from  the  names  of  the 
plotters  themselves,  the  attack  location,  or  still  other  factors. 


CHAPTER  FOUR 


Classification  of  Plots 


With  the  caveats  described  in  the  previous  chapter  kept  in  mind,  it  is  possible  to  categorize  the 
plots  hatched  in  Europe  from  2006  to  2010  according  to  the  continuum  described  in  Chapter 
One.  With  a  certain  necessary  level  of  oversimplification,  it  is  possible  to  say  that,  of  the  30 
plots  identified,  excluding  the  three  that  were  not  categorized  by  type, 

•  21  (70  percent)  can  be  classified  as  independent.  A  plot  is  considered  independent  when 
the  individual  or  cluster  behind  it  acted  with  no  apparent  operational  support  from 
AQAM.  Of  those  plots,  some  were  quintessentially  independent  in  the  sense  that  they 
were  carried  out  by  attackers  with  no  connection  whatsoever  not  only  to  any  group  but 
even  to  any  other  like-minded  individual.  That  was  the  case,  for  example,  in  the  instances 
of  quintessential  “lone  wolves,”  such  as  Roshonara  Choudhry.1  Other  plots  were  carried 
out  by  individuals  who  had  some  degree  of  contact  with  like-minded  individuals  or  with 
AQAM.  But  a  plot  is  considered  independent  if  AQAM,  although  somehow  connected 
to  the  perpetrator,  had  no  operational  involvement  in  the  plot  and  if  the  linkage  between 
the  two  did  not  translate  into  any  enhancement  of  the  plot’s  quality.  That  was  the  case, 
for  example,  of  Mohammed  Muhidin  Gelle,  whose  alleged  links  to  al  Shabaab  in  no  way 
influenced  the  execution  of  his  attack,2  and  of  Rajib  Karim,  whose  online  communica¬ 
tions  with  al  Awlaki  did  not  apparently  provide  him  with  any  operational  expertise.3 


1  Choudhry  was  a  King’s  College  student  who  admitted  radicalizing  online  by  watching  sermons  of  Yemen-based  cleric 
Anwar  al  Awlaki  and  in  May  2010  stabbed  British  Member  of  Parliament  Stephen  Timms  to  punish  him  for  his  support  for 
the  Iraq  war. 

2  On  January  1,  2010,  Gelle,  a  28-year-old  Somali  man  and  long-time  Danish  resident,  forced  his  way  into  the  Aarhus 
home  of  Kurt  Westergaard,  the  cartoonist  who  had  drawn  one  of  the  cartoons  of  the  prophet  Mohammed  published  by 
Danish  daily  Jyllands-Posten  in  2005.  Armed  with  an  axe  and  a  knife,  Gelle  attacked  the  74-year-old  cartoonist,  who  man¬ 
aged  to  hide  in  a  panic  room.  Police  officers  shot  Gelle  in  the  knee  and  hand  before  arresting  him.  Danish  security  services 
revealed  that  Gelle  “has  close  relations”  to  al  Shabaab  and  that  he  “is  also  suspected  of  having  been  involved  in  terror-related 
activities  during  his  stay  in  East  Africa”  (Politiets  Efterretningstjeneste,  undated).  Gelle,  in  fact,  had  been  arrested  in  Nai¬ 
robi  on  July  30,  2009,  along  with  four  others,  during  a  meeting  of  senior  al  Shabaab  leaders.  According  to  Kenyan  authori¬ 
ties,  the  men  were  planning  an  attack  against  U.S.  Secretary  of  State  Hillary  Clinton,  who  visited  the  country  in  August 
2009.  Briefly  detained,  Gelle  was  deported  to  Denmark,  and  no  charges  were  filed  against  him.  Although  it  publicly  praised 
the  attack,  al  Shabaab  did  not  claim  responsibility  for  it.  Most  relevantly,  there  are  no  indications  that  the  group  had  any 
operational  involvement  in  the  attack,  which,  incidentally,  was  highly  amateurish  in  nature. 

3  Karim  is  a  native  of  Bangladesh  who  obtained  an  information  technology  job  with  British  Airways  in  Newcastle,  Eng¬ 
land,  in  2006.  Already  a  member  of  the  militant  group  Jammat-ul  Mujahideen  Bangladesh  in  his  native  country,  Karim 
admitted  to  obtaining  the  job  and  acting  as  a  “liberal  Muslim”  during  his  time  in  Newcastle  while  in  reality  planning  an 
attack  all  along.  Through  the  Internet,  Karim  established  communication  with  al  Awlaki,  the  U.S. -born  cleric  affiliated 
with  al  Qaeda  in  the  Arabian  Peninsula,  expressing  his  desire  to  conduct  actions  against  Britain.  Karim  was  arrested  in 
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•  one  (3.33  percent)  can  be  classified  as  external.  A  plot  is  considered  external  if  it  was 
conceived,  planned,  and  executed  by  AQAM  without  any  support  or  participation  from 
individuals  inside  Europe.  In  reality,  the  one  external  plot  (the  Mickey  Mouse  Project/ 
Headley  case)  could  also  be  categorized  as  a  hybrid  plot,  since  David  Coleman  Headley 
reportedly  sought  to  recruit  various  Europe-based  militants  to  carry  out  the  attack.* * * 4 

•  eight  (26.66  percent)  can  be  classified  as  hybrid.  In  these  cases,  a  homegrown  group  that 
formed  independently  in  Europe  managed  to  establish  some  ties  to  AQAM  and  obtain 
operational  support  from  it.  The  level  of  support  from  AQAM  differed  in  intensity  in 
different  cases.  In  some  cases,  AQAM  trained  individuals  and  sent  them  back  to  Europe 
with  instructions  to  carry  out  attacks  against  specified  or  unspecified  targets.  In  other 
cases,  the  connection  was  limited  to  a  short  training  stint  with  the  group,  and,  upon 
returning  to  Europe,  the  European  militants  acted  without  any  involvement  of  the  group 
that  provided  the  training.  But,  for  a  plot  to  be  categorized  as  hybrid,  the  linkage  between 
the  Europe-based  individual  or  cluster  and  AQAM  has  to  have  had  an  impact  on  the 
plot’s  planning  or  execution,  providing  the  plotters  with  some  level  of  professional  exper¬ 
tise.  It  must  be  noted  that  in  none  of  these  hybrid  cases  was  there  evidence  that  AQAM 
attempted  to  formally  recruit  those  involved  in  plotting  attacks.  Rather,  a  linkage  was 
established  via  the  initiative  of  the  Europ-based  cluster. 

The  data  clearly  show  that  independent  plots  are  by  a  large  margin  the  most  common 
kind.  These  numbers  are  consistent  with  patterns  seen  in  previous  years.  In  a  2009  report  that 
analyzed  not  just  plots  but,  more  broadly,  all  arrests  for  terrorism-related  activities,  Europol 
noted  that  “two  thirds  of  the  individuals  arrested  on  suspicion  of  involvement  in  Islamist  ter¬ 
rorism  could  not  be  linked  to  terrorist  organizations  known  to  the  authorities.”  Europol  con¬ 
cluded  that  this  trend 

could  be  seen  as  an  indication  of  the  existence  of  individuals  or  groups  unaffiliated  to  a 
terrorist  organization  but  adhering  to  a  common  ideology  of  global  jihad,  as  promoted  by 
al- Qaeda.  It  also  underlines  the  fact  that  al-  Qaeda  is  evolving  into  a  sort  of  franchise  organ¬ 
isation,  which  acts  as  a  point  of  reference  for  independent  terrorist  groups  or  individuals.5 

Sageman’s  analysis  of  jihadist  plots  against  the  West  (which  included  not  just  Europe  but 
also  North  America  and  Australia)  between  2004  and  2008  yielded  similar  results.  According 
to  his  database,  in  fact,  78  percent  of  the  plots  against  the  West  originated  in  “autonomous 
homegrown  groups  without  any  connection,  direction  or  control  from  al-Qaeda  Core  or  its 
allies.”6  Sageman’s  data  also  show  that  60  percent  of  “global  neo-jihadi  terrorist  networks  from 
2004  onwards  did  not  have  any  formal  training  from  foreign  terrorist  groups.”7  It  seems  there- 


February  2010  and  convicted  a  year  later  of  four  counts  of  preparing  acts  of  terrorism,  allegedly  seeking  to  bomb  a  British 
Airways  plane.  Despite  the  frequent  email  communication  between  Karim  and  al  Awlaki,  in  which  the  latter  urged  the 

former  to  scout  targets,  British  authorities  have  not  produced  any  evidence  indicating  that  al  Awlaki,  AQAP,  or  any  other 

group  provided  Karim  with  any  operational  skills. 

4  The  Mickey  Mouse  Project,  as  it  was  called  by  the  conspirators,  was  the  plan  hatched  by  U.S.-based  militant  Headley 
(aka  Daood  Sayed  Gilani)  and  senior  al  Qaeda  planner  Ilyas  Kashmiri  to  carry  out  attacks  in  Denmark,  specifically  against 
Jyllands-Posten  (either  the  paper’s  Aarhus  headquarters  or  its  centrally  located  Copenhagen  offices,  both  of  which  Headley 
scouted). 

5  Europol,  2009,  p.  21. 

6  Sageman,  2009a. 

7  Sageman,  2009a. 
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fore  apparent  that,  no  matter  what  samples,  definitions,  and  scope  are  adopted  in  the  analysis, 
the  evidence  clearly  shows  that  the  majority  of  European  (and  Western)  plots,  networks,  and 
militants  are  homegrown  or  independent  in  nature. 

However,  this  quantitative  result  should  not  preclude  a  qualitative  analysis  of  the  data. 
Although  it  is  unquestionably  true  that  the  majority  of  plots  are  independent,  it  is  also  equally 
true  that  the  most-sophisticated  and  most-dangerous  plots  are  those  involving  a  linkage  with 
AQAM.  Deciding  what  qualifies  a  plot  as  “serious”  is  an  inevitably  arbitrary  and  speculative 
task,  particularly  when  complete  information  is  not  always  available.  Using  a  set  of  criteria 
similar  to  those  adopted  by  Paul  Cruickshank,  this  paper  considers  a  plot  serious  if  it  killed 
or  could  have  reasonably  killed  a  significant  number  of  people  (at  least  a  dozen)  and  if  the 
alleged  perpetrators  had  already  acquired  the  necessary  weapons  and  explosives  with  detona¬ 
tors.8  According  to  these  criteria,  only  ten  of  the  30  plots  can  be  considered  “serious.”9  Of  these 
ten  serious  plots,  five  are  independent  (the  Cologne  train  bombings,10  the  Vollsmose  case,* 11 
the  Doctors’  plot,12  Andrew  Ibrahim,13  and  the  Santa  Barbara  bombing14),  and  five  are  hybrid 
(the  Transatlantic  plot,15  the  Glasvej  case,16  Operation  Alberich,17  Operacion  Cantata,18  and 


8  Cruickshank,  2010,  p.  2. 

9  At  least  two  of  the  three  plots  from  December  2010  (the  Stockholm  suicide  bombing  and  the  Jyllands-Posten  plot)  seem 
to  be  serious,  but,  given  the  lack  of  complete  information,  this  report  has  refrained  from  classifying  them  as  such. 

10  In  July  2006,  two  Lebanese  students,  Youssef  Mohamad  El  Hajdib  and  Jihad  Hamad,  placed  two  suitcases  filled  with 
explosives  on  two  commuter  trains  near  Cologne.  Defective  detonators  failed  to  ignite  the  two  homemade  devices. 

11  In  September  2006,  Danish  authorities  arrested  nine  men  of  various  backgrounds  in  the  Vollsmose  suburb  of  Odense, 
accusing  them  of  planning  attacks  against  unspecified  targets  in  the  country.  Ammonium  nitrate,  metal  splinters,  and 
explosive  substances  were  allegedly  found  in  the  arrested  men’s  possession.  Only  three  of  the  suspects  were  later  convicted. 

12  In  July  2007,  after  car  bombs  they  had  parked  outside  popular  London  nightclubs  failed  to  explode,  two  foreign  doctors 
and  long-time  British  residents  rammed  their  car  into  the  Glasgow  airport’s  entrance.  One  assailant  died,  and  the  other  was 
arrested  and  later  sentenced  to  life  in  prison. 

13  In  April  2008,  Muslim  convert  Andrew  Ibrahim  was  arrested  at  his  domicile  in  Bristol  after  police  received  a  tip  from 
the  local  Muslim  community.  Searching  his  apartment,  police  found  that  he  had  manufactured  hexamethylene  triperoxide 
diamine  (a  peroxide-based  explosive),  sewn  two  suicide  vests,  constructed  a  detonator,  and  collected  shrapnel.  He  was  sen¬ 
tenced  to  life  in  prison  in  September  2009  for  “engaging  in  conduct  with  the  intention  to  commit  acts  of  terrorism”  and 
“possessing  articles  for  terrorist  purposes”  (Crown  Prosecution  Service,  undated-b). 

14  In  October  2009,  Libyan  national  and  long-time  Milan  resident  Mohammed  Game  attempted  to  enter  the  Santa  Bar¬ 
bara  military  barracks  in  the  Lombard  city.  When  confronted  by  the  guard,  he  detonated  an  improvised  explosive  device  he 
carried,  severely  injuring  himself  and  lightly  wounding  the  guard.  The  ensuing  investigation  led  to  two  Milan-based  North 
African  men  who  had  allegedly  helped  Game  with  his  plot. 

15  In  August  2006,  British  authorities  arrested  several  UK-based  militants  planning  to  blow  up  transatlantic  flights  in  mid¬ 
air  by  detonating  explosives  they  would  have  smuggled  onboard.  The  investigation  uncovered  extensive  links  between  the 
men  and  al  Qaeda  in  Pakistan. 

16  In  September  2007,  Danish  authorities  arrested  eight  men  in  Copenhagen  and  accused  them  of  planning  attacks  in  the 
country.  Only  two  of  them  were  convicted  of  conspiring  to  commit  acts  of  terrorism  and  of  manufacturing  explosives.  One 
of  the  men,  Danish  citizen  of  Pakistani  descent  Hammad  Khurshid,  had  reportedly  received  training  in  explosives  from 
al  Qaeda  in  Pakistan. 

17  In  September  2007,  German  authorities  arrested  three  men  who  had  stored  large  quantities  of  explosive  material  for 
planning  various  attacks  against  American  targets  in  southwest  Germany.  The  men  had  obtained  extensive  training  from 
the  Islamic  Jihad  Union,  an  Uzbek  al  Qaeda  affiliate  based  in  Pakistan. 

18  In  January  2008,  Spanish  authorities  arrested  a  group  of  mainly  Pakistani  men  who  were  allegedly  planning  suicide 
attacks  against  the  Barcelona  metro  system.  According  to  Spanish  authorities,  the  men,  who  were  convicted  in  2009,  had 
close  operational  links  to  the  Pakistani  Taliban  (Tehrik-i-Taliban  Pakistan). 
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the  2009  Christmas  bombing19).  It  is  noteworthy  that  independent  plots,  which  represent  more 
than  two-thirds  of  total  plots,  constitute  only  half  of  the  serious  plots. 

Even  among  these  serious  operations,  it  is  fair  to  say  that  the  plots  in  which  AQAM  was 
either  directly  or  indirectly  involved  were,  for  the  most  part,  significantly  more  sophisticated 
than  most  of  the  independent  plots.  The  analysis  of  the  plots  would  be  flawed  if  it  did  not 
distinguish  from  a  qualitative  perspective  between  independent  plots  of  mindboggling  ama¬ 
teurism,  such  as  the  Cologne  train  bombings  or  the  Santa  Barbara  bombing,  and  massive 
operations,  such  as  the  2006  Transatlantic  plot  or  Operation  Alberich.  In  three  of  the  five 
independent  cases  (the  Cologne  train  bombings,  the  Doctors’  plot,  and  the  Santa  Barbara 
bombing),  the  explosives  failed  to  either  properly  or  completely  detonate.  In  the  other  two 
cases  (the  Vollsmose  case  and  Ibrahim),  authorities  intervened  as  the  suspects  were  still  mixing 
the  explosives.  In  both  cases,  however,  it  seems  that  bomb-making  instructions  had  been 
obtained  from  the  Internet  and  that  no  suspect  had  received  actual  training  in  explosives. 

In  four  out  of  the  five  serious  hybrid  cases,  on  the  other  hand,  no  attack  materialized 
because  authorities  arrested  the  cell  members  during  the  preparation  stage.  Although  it  is 
impossible  to  say  how  the  plots  would  have  developed  had  authorities  not  detected  them,  it 
is  noteworthy  that,  in  all  four  cases,  at  least  one  member  of  the  cell  had  obtained  training 
in  bomb-making  from  AQAM  in  Pakistan  (the  explosives  carried  by  Abdulmutallab,  on  the 
other  hand,  had  been  assembled  in  Yemen).  This  element  is,  according  to  most  experts,  of 
crucial  importance.  Although  it  has  become  fashionable  to  describe  the  Internet  as  a  “virtual 
training  camp,”  this  designation  might  be  deceiving.20  The  Internet  unquestionably  provides 
aspiring  terrorists  with  a  wide  range  of  useful  operational  information,  but  most  experts  agree 
that  an  individual  is  highly  unlikely  to  be  able  to  assemble  an  explosive  device  solely  based 
on  instructions  obtained  online.  And,  if  the  individual  can  indeed  successfully  complete  this 
highly  dangerous  endeavor,  the  bomb  resulting  from  it  is  likely  to  be  rudimentary  and  of 
limited  detonating  power.  Most  experts  believe  that  even  Inspire,  the  slick,  English-language 
magazine  first  published  in  July  2010  by  al  Qaeda  in  the  Arabian  Peninsula  (AQAP),  is  more 
important  for  its  value  as  propaganda  for  al  Qaeda  than  for  any  major  operational  impact  it 
might  have.21 

In  substance,  most  experts  are  adamant  that  Internet  instructions  cannot  replace  the 
necessary  physical  training  that  any  aspiring  terrorist  must  obtain  from  an  experienced  bomb 
maker.22  Interestingly,  it  seems  that  some  European  jihadists  share  this  view.  Abdulla  Ahmed 
Ali,  the  ringleader  of  the  2006  Transatlantic  plot  cell,  testified  at  his  trial  that  he  found  online 
instructions  to  build  explosives  “wishy-washy”  and  stated  that  “the  whole  point  of  us  learning 
how  to  do  it  from  someone  who’s  done  it  before — or  someone  would  know  about  the  thing — 
is  obviously  [that]  it’s  quite  dangerous  dealing  with  these  materials.  We  don’t  want  to  injure 


19  On  December  25,  2009,  Umar  Farouk  Abdulmutallab,  a  Nigerian  man  who  had  reportedly  radicalized  while  studying 
in  London,  attempted  to  detonate  explosives  he  had  concealed  in  his  underwear  in  the  final  phase  of  an  Amsterdam-to- 
Detroit  flight.  A  flaw  in  the  device  and  the  prompt  reaction  of  some  passengers  prevented  the  detonation. 

20  Nesser,  2008b,  p.  235. 

21  Interviews  with  American  and  British  officials  (Washington  D.C.,  January  2011). 

22  Kenney,  2010. 
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ourselves  or  anything.”23  Not  surprisingly,  Sageman’s  database  reveals  that  plots  hatched  over 
the  last  20  years  by  those  who  had  received  formal  training  in  explosives  were  four  times  more 
likely  to  have  been  successful  than  those  involving  operatives  without  that  training.24 


23  As  reported  in  Cruickshank,  2009. 

24  Sageman,  2009b. 
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Identifying  Linkage  Patterns 


Analysis  of  the  data  presented  makes  clear  that  al  Qaeda  central  and  AQAM  are  still  very 
much  relevant,  occasionally  directly  planning  attacks  against  Europe  and  (more  frequently) 
indirectly  planning  attacks  in  Europe  by  providing  European  homegrown  networks  with  the 
necessary  expertise  to  overcome  the  knowledge  gap  that  mars  the  operational  skills  of  indepen¬ 
dent  networks.  It  is  evident  that  the  deeper  the  operational  connectivity  between  a  European 
cluster  and  AQAM,  the  deeper  the  threat  the  former  poses. 

Because  the  linkage  between  the  homegrown  cluster  and  AQAM  is  what  makes  the  former 
gain  significant  operational  expertise  and  therefore  become  more  dangerous,  it  is  important  to 
see  where  and  how  such  linkage  takes  place.  In  many  cases,  identifying  how  this  connection 
was  made  is  extremely  challenging,  either  because  that  information  has  not  been  made  public 
or  because  authorities  themselves  have  been  unable  to  make  a  determination.  Even  examining 
cases  beyond  those  in  the  dataset — i.e.,  looking  at  cases  in  which  European  clusters  established 
the  linkage  and  then  did  not  plan  attacks  in  Europe  but  instead  decided  to  fight  in  armed  con¬ 
flicts,  plan  attacks  outside  of  Europe,  or  simply  go  back  to  Europe  without  planning  attacks 
there — it  is  apparent  that  only  in  a  few  cases  is  it  possible  to  exactly  pinpoint  how  the  connec¬ 
tion  was  made. 

It  is  nevertheless  possible,  based  on  a  review  of  court  transcripts  and  media  reports,  to 
observe  some  general  patterns.  Throughout  the  1990s  and  the  early  2000s,  a  handful  of  mosques 
spread  throughout  Europe  played  a  crucial  role  in  connecting  unaffiliated  jihad  enthusiasts 
with  established  groups.  Such  places  as  London’s  Finsbury  Park  mosque,  the  al  Quds  mosque 
in  Hamburg,  the  Islamic  Cultural  Institute  (also  known  as  the  viale  Jenner  mosque)  in  Milan, 
the  via  Quaranta  mosque  in  Milan,  and  the  Multikulturhaus  in  Neu-Ulm  were  either  run  or 
extensively  populated  by  individuals  with  direct  connections  to  al  Qaeda  and  affiliated  groups, 
and  they  often  served  as  agents  of  radicalization,  recruitment,  and  linkage.1 

The  less  permissive  environment  of  the  last  few  years  has  put  an  end  to  the  era  of  openly 
jihadist  mosques.  Some  of  the  old  leadership  of  the  most-militant  mosques  has  been  arrested  or 
deported  or  has  voluntarily  left  for  various  reasons.  In  some  cases,  the  leadership  has  remained 
virtually  the  same  but  has  toned  down  its  rhetoric  and  stopped  or  significantly  diminished 
its  recruiting  and  linkage  efforts.  In  some  cases,  to  be  sure,  these  changes  are  just  facade,  and 
such  activities  are  yet  taking  place,  but  in  a  more  discrete  fashion.  Some  mosques  still  play  an 
important  role  in  the  radicalization  process  and  in  the  formation  of  spontaneous  clusters  of 
like-minded  individuals.  However,  most  of  the  activities  that  normally  follow  such  initial  steps 
no  longer  take  place  in  mosques  but  are  instead  conducted  in  small  private  circles  outside  of 


1  Vidino,  2005. 
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the  mosques.2  Although  exceptions  do  exist — for  instance,  the  Taiba  (previously  known  as  al 
Quds)  mosque  in  Hamburg,  closed  down  by  authorities  in  August  2010 — it  is  fair  to  state, 
as  Europol  did  in  its  2009  annual  report,  that  “the  role  of  mosques  in  the  radicalisation  and 
recruitment  of  Islamist  terrorists  is  declining.”3 

In  recent  years,  experts  and  policymakers  have  devoted  significant  attention  to  the  role  of 
the  Internet,  prisons,  and  so-called  gateway  organizations  in  the  dynamics  of  European  jihad- 
ism.  The  Internet,  whether  through  jihadist  websites  and  chat  rooms  or  mainstream  social¬ 
networking  sites,  has  unquestionably  become  a  major  factor  in  jihadist  circles,  in  Europe  as 
elsewhere.4  Authorities  have  been  equally  concerned  about  the  presence  of  jihadist  ideology 
and  activists  inside  prisons  and  have  attempted  to  devise  solutions  to  counter  them.5  Finally, 
the  role  of  assorted  Islamist  and  religiously  conservative  organizations  of  various  natures,  such 
as  Hizb  ut-Tahrir  and  Tablighi  Jamaat,  which  are  not  directly  involved  in  or  may  not  even  sup¬ 
port  violence  but  could  potentially  facilitate  a  progression  in  its  direction,  has  been  debated. 

Concerns  about  these  three  areas  are  largely  justified.  However,  the  danger  presented  by 
the  Internet,  prisons,  and  gateway  organizations  seems  to  be  most  intense  in  the  radicaliza¬ 
tion  phase  rather  than  in  linkage.  Scores  of  European  jihadists  have  indeed  received  their  first 
exposure  to  jihadist  ideology  in  front  of  a  computer,  in  a  jail  cell,  or  by  interacting  with  mem¬ 
bers  of  nonviolent  Islamist  organizations.  Yet,  the  number  of  cases  in  which  these  three  venues 
provided  an  aspiring  jihadist  with  an  actual,  physical  connection  to  AQAM  is  limited.  There 
have  been  several  instances  in  which  a  conversation  struck  up  among  visitors  of  a  chat  room,  a 
connection  made  behind  bars,  or  interaction  with  members  of  gateway  organizations  have  led 
to  such  an  outcome.  But  the  real  danger  posed  by  these  three  venues  lies  in  their  radicalizing 
potential  rather  than  in  their  ability  to  link  already  radicalized  individuals  to  AQAM.6 

Basing  its  acceptance  policy  on  selection  rather  than  outreach  and  recruitment,  AQAM 
tends  to  open  itself  to  individuals  whose  background  and  commitment  can  somehow  be  veri¬ 
fied.7  Therefore,  personal  connections  are  of  paramount  importance,  as  they  alone  guarantee 
the  necessary  degree  of  trust.  These  trust  relationships  are  built,  in  most  cases,  through  exten¬ 
sive  and  face-to-face  rapport  established  between  unaffiliated  jihad  enthusiasts  and  individu¬ 
als  with  connections  to  AQAM.  Often,  these  latter  individuals  are  committed  militants  who 
have  fought  in  various  conflicts  and  established  solid  links  to  various  al  Qaeda-affiliated  net¬ 
works  outside  of  Europe.8  Charismatic,  generally  older,  and,  unlike  their  predecessors,  mostly 
European-born,  they  do  not  “recruit”  in  the  traditional  sense  of  the  word;  rather,  they  “make 
things  happen,”  connecting  various  European  individuals  and  clusters  with  one  another  or 
with  AQAM.9 


2  Neumann  and  Rogers,  2007,  p.  38. 

3  Europol,  2009,  p.  21. 

4  For  a  recent  overview,  see,  for  example,  Musawi,  2010. 

5  For  an  overview,  see  International  Centre  for  the  Study  of  Radicalisation  and  Political  Violence,  2010. 

6  Neumann,  2008,  pp.  31-34. 

7  Interviews  with  Algerian  (Washington,  D.C.,  May  2007),  American  (Washington,  D.C.,  June  2010),  British  (London, 
April  2010),  Egyptian  (Cairo,  December  2009),  Italian  (Milan,  July  2010),  and  Pakistani  (Washington,  D.C.,  October 
2010),  officials. 

8  See,  for  example,  Sakerhetspolisen,  2010,  p.  3. 

9  Nesser,  2006. 
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These  jihad  entrepreneurs,  who  often  operate  “outside  the  organisational  framework  of 
mosques,”  are  the  main  actors  linking  European  homegrown  clusters  to  AQAM.10  Such  indi¬ 
viduals  as  Rashid  Rauf,  El  Aroud,  and  Mevliit  Kar,  European  jihad  entrepreneurs  of  the  last  five 
years,  have  been  involved  in  connecting  various  European  networks  to  Pakistan  and,  in  many 
cases,  have  directly  participated  in  the  planning  of  terrorist  attacks.  The  ways  in  which  they 
came  to  meet  the  individuals  and  clusters  they  later  connected  to  AQAM  are  extremely  varied. 
In  many  cases,  that  encounter  took  place  in  one  of  the  abovementioned  risk  areas — mosques, 
prisons,  gateway  organizations  and,  to  a  lesser  degree,  the  Internet.  But  such  encounters  could 
take  place  anywhere,  from  Internet  cafes  to  gyms  to  universities  to  refugee  centers.  Preexisting 
social  and  family  networks  play  a  crucial  role,  as  they  reinforce  trust  among  militants. 

The  importance  of  fortuitousness  should  not  be  overlooked  when  examining  linkage  pat¬ 
terns.* 11  The  story  of  the  formation  of  a  “German  jihadist  scene”  in  Pakistan  is  in  that  regard 
very  telling  and  hardly  an  isolated  case.  By  the  mid-2000s,  a  network  of  jihad  enthusiasts  that 
had  formed  around  the  Multikulturhaus  in  the  Bavarian  town  of  Neu-Ulm  had  decided  to 
leave  Europe  to  fight.12  Two  of  the  members  of  the  cluster,  Fritz  Gelowicz  and  Adem  Yilmaz, 
hoped  to  reach  either  Chechnya  or  Iraq  to  join  the  local  insurgencies.  Prevented  by  logisti¬ 
cal  difficulties  from  doing  so,  they  decided  to  travel  to  Damascus  both  to  study  Arabic  and, 
most  importantly,  to  make  connections  with  individuals  who  could  aid  them  in  their  effort. 
In  Damascus,  the  two  had  a  chance  encounter  with  a  group  of  Azerbaijani  militants  who  told 
them  to  go  train  in  Pakistan.13 

The  Azerbaijanis  reportedly  put  Gelowicz  and  Yilmaz  in  touch  with  militants  from  the 
Islamic  Jihad  Union  (IJU),  a  splinter  group  of  the  Islamic  Movement  of  Uzbekistan.14  Once 
in  Pakistan,  the  two  men  received  training  from  IJU  but,  instead  of  traveling  to  Chechnya  or 
Iraq,  as  initially  planned,  decided  to  return  to  Germany  and  plan  attacks  there.  In  Septem¬ 
ber  2007,  Gelowicz  and  Yilmaz  were  arrested  by  German  authorities  for  allegedly  planning 
massive  bombing  attacks  against  various  American  targets  in  Germany  (Operation  Alberich). 
Moreover,  the  purely  fortuitous  connection  with  IJU  established  by  Gelowicz  and  Yilmaz 
opened  the  doors  of  Pakistan  to  many  other  German  militants  who  were  directly  or  indirectly 
in  contact  with  the  two  would-be  attackers.  Today,  according  to  German  authorities,  dozens 
of  German  jihad  enthusiasts  have  made  their  way  to  IJU-run  camps,  and,  although  some  have 
settled  with  their  families  in  what  have  been  termed  “German  colonies”  in  tribal  areas  of  Paki¬ 
stan,  some  have  been  killed  in  action,  and  others  have  made  their  way  back  to  Germany.15  As 
one  of  the  German  militants  who  joined  the  Islamic  Movement  of  Uzbekistan  in  Waziristan 
said  in  a  jihadist  chat  room,  “we  wanted  to  go  to  one  of  the  countries  in  which  the  jihad  ...  is 
led.  Whether  the  trip  was  to  Somalia,  Palestine,  Chechnya,  or  Indonesia  played  no  role  for  us. 
The  main  thing  was  that  we  went  there.”16 


10  Europol,  2009,  p.  21. 

1 1  Interviews  with  American  (Washington,  D.C.,  November  2010),  British  (London,  December  2009),  Dutch  (The  Hague, 
December  2009),  and  German  officials  (Stuttgart,  May  2008). 

12  Steinberg,  2010,  pp.  14-19. 

13  Interviews  with  German  officials  (Washington,  D.C.,  October  2010);  Musharbash,  Rosenbach,  and  Stark,  2010. 

14  Steinberg,  2008. 

15  Musharbash,  Rosenbach,  and  Stark,  2010;  Musharbash,  Stark,  and  Koelbl,  2010. 

16  Quote  from  Yassin  Chouka  (aka  Abu  Ibrahim  al  Almani),  cited  in  Roggio,  2011. 
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Diversity  in  Destinations  and  Makeup 


Whether  initially  established  in  Europe,  in  the  country  of  destination,  or  in  a  third  country, 
the  linkage  between  European  individuals  or  clusters  and  AQAM  in  most  cases  leads  the 
former  to  spend  some  time  training  or  fighting  (or  both)  in  one  of  five  places:  Pakistan,  Soma¬ 
lia,  Yemen,  Iraq,  or  the  Maghreb.  The  tribal  areas  of  Pakistan  are  unquestionably  the  most 
common  destination  for  European  jihadists  and  the  one  where  they  find  the  best  structure. 1 
Operating  in  the  region  are  a  vast  and  complex  array  of  groups  and  networks  that  act  with 
varying  degrees  of  independence  but  for  the  most  part  increasingly  share  al  Qaeda’s  worldview 
and  agenda.  European  militants  have  been  known  to  link  up  with  several  of  these  groups  and, 
in  some  cases,  with  more  than  one  at  the  same  time,  highlighting  the  high  level  of  intercon¬ 
nectivity  among  the  actors  in  the  region.  An  analysis  of  the  hybrid  plots  against  Europe  over 
the  last  five  years,  and  which  therefore  disregards  the  many  more  numerous  cases  of  European 
jihadists  who  connected  with  AQAM  in  Pakistan  and  did  not  plan  attacks  in  Europe,  clearly 
shows  such  diversity.  At  least  one  was  linked  to  al  Qaeda  central  (the  Transatlantic  plot), 
one  to  Tehrik-i-Taliban  Pakistan  (Operacion  Cantata),  and  one  to  the  Uzbek  IJU  (Operation 
Alberich).  The  one  external  plot  (the  Mickey  Mouse  Project/Headley  case)  was  similarly  linked 
to  Pakistan  and  apparently  involved  both  the  al  Qaeda  core  and  Lashkar-i-Taiba.2 

The  pipeline  to  Pakistan,  well  established  throughout  the  1990s,  continued  after  the  U.S. 
invasion  of  Afghanistan,  as  some  European  militants  linked  up  with  al  Qaeda  and  various 
Pakistani  jihadist  outfits  that  operated  camps  and  facilities  in  the  country.  In  the  first  half  of 
the  2000s,  the  flow  from  Europe  was  limited  and  involved  mostly  individuals  who  had  family 
connections  to  Pakistan.  Militants  from  the  United  Kingdom,  home  to  Europe’s  oldest  and 
largest  Pakistani  diaspora  community,  comprised  the  largest  contingent  of  European  recruits. 
Most  jihad  enthusiasts  from  other  European  countries,  who  did  not  possess  these  personal  con¬ 
nections,  were  generally  unable  to  make  their  way  to  the  geographically  and  culturally  imper¬ 
vious  tribal  areas  of  Pakistan. 

By  2006,  the  formation  of  more-stable  facilities  in  Pakistan  and  the  presence  of  a  greater 
number  of  well-connected  jihad  entrepreneurs  outside  of  the  United  Kingdom  made  access 
to  training  in  AQAM’s  Pakistani  camps  easier  for  militants  throughout  continental  Europe.3 
Particularly  remarkable  is  the  development  in  Germany,  where  authorities  believe  that,  in  2009 
alone,  some  40-50  militants  traveled  to  Pakistan  to  receive  training  or  to  fight  in  the  region  (or 
both).  Confirming  this  trend,  in  February  2009,  then-U.S.  Director  of  National  Intelligence 


1  For  an  excellent  overview  of  the  importance  of  the  region  for  Western  jihadists,  see  Cruickshank,  2010. 

2  United  States  of  America  v  Ilyas  Kashmiri  and  Others,  undated. 

3  Cruickshank,  2010;  interviews  with  European  and  American  intelligence  officials  (various  cities,  various  years). 
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Dennis  Blair  said  in  testimony  before  the  U.S.  Senate  that  “the  primary  threat  from  Europe- 
based  extremists  stems  from  al-Qa‘ida  and  Sunni  affiliates  who  return  from  training  in  Paki¬ 
stan  to  conduct  attacks  in  Europe  or  the  United  States.”4 

Since  its  formation  in  January  2009  from  the  merger  of  al  Qaeda-affiliated  networks 
in  Saudi  Arabia  and  Yemen,  al  Qaeda  in  the  Arabian  Peninsula,  based  largely  in  Yemen,  has 
been  considered  a  potential  threat  to  European  security.5  Since  the  1990s,  small  numbers  of 
European  jihad  enthusiasts  have  traveled  to  Yemen  to  study  Arabic  and  Islam  in  small  private 
schools  or  at  the  Iman  University  of  Sana’a,  an  institution  headed  by  known  al  Qaeda  sup¬ 
porter  Abdul  Majeed  al  Zindani.  Authorities  believe  that  some  of  these  individuals,  such  as 
former  London  resident  and  2009  Christmas  bomber  Abdulmutallab,  have  connected  with 
local  al  Qaeda-affiliated  networks. 

Authorities  harbor  similar  fears  about  Somalia.  During  the  last  five  years,  a  small  but 
increasing  number  of  European  militants  have  joined  the  ranks  of  al  Shabaab,  the  local  Islamist 
outfit  that  views  itself  as  the  East  African  branch  of  al  Qaeda.6  At  first,  most  of  the  European- 
based  volunteers  who  joined  al  Shabaab  were  ethnic  Somalis  driven  by  the  wave  of  patriotic 
fervor  that  pervaded  their  communities  after  the  2006  Ethiopian  invasion.  The  motivations 
of  the  wave  of  volunteers  who  traveled  to  Somalia  in  the  months  after  the  Ethiopian  pullout 
of  January  2009  may  have  been  different,  however,  as  al  Shabaab ’s  appeal  to  patriotic  senti¬ 
ments  had  lost  its  main  raison  d’etre.  Considering  this  change  in  political  landscape  and  the 
increased  use  of  religious,  global,  and  al  Qaeda-inspired  imagery  in  al  Shabaab ’s  rhetoric,  it  is 
fair  to  state  that  it  is  likely  that  some  of  the  volunteers  who  have  recently  joined  the  group  are 
more  attracted  by  its  global  jihadist  ideology  than  motivated  by  patriotic  fervor.  An  additional 
confirmation  of  this  assessment  is  provided  by  the  small  yet  significant  number  of  non— ethnic 
Somalis  who  have  joined  al  Shabaab  during  the  last  few  years.7 

The  phenomenon  of  European  militants  traveling  to  Somalia  seems  to  touch  several 
countries.  British  authorities,  for  example,  have  publicly  expressed  their  concerns  over  a  “steady 
stream”  of  young  men  traveling  from  the  United  Kingdom  to  Somalia.8  Swedish  security  ser¬ 
vices  believe  that  some  20  Somalis  have  left  Sweden  to  fight  alongside  al  Shabaab  in  recent 
years  and  that  at  least  five  of  them  have  been  killed.9  UK-  and  Denmark-based  Somalis  have 
also  reportedly  perpetrated  suicide  bombings  in  Somalia.10  Although  authorities  have  not 
intercepted  any  plot  in  Europe  with  direct  connections  to  Somalia,  they  fear  that  European 
militants  who  have  received  training  from  al  Shabaab  might  decide  to  carry  out  attacks  against 
Europe  in  the  future,  and  they  see  the  Gelle  case  as  a  potential  harbinger. 

Although  the  conflict  there  has  significantly  decreased  in  intensity  over  the  last  two  years, 
Iraq  also  continues  to  be  a  destination  for  European  militants.  Since  the  U.S.  invasion  of 2003, 
several  Iraqi  outfits  have  benefited  from  an  influx  of  foreign  fighters  driven  by  a  desire  to  con¬ 
front  American  forces.  Most  of  them  have  come  from  the  Arab  Gulf  or  North  Africa,  but  it  is 


4  Blair,  2009. 

5  Europol,  2010,  p.  24. 

6  Committee  on  Foreign  Relations,  2010. 

7  See  Vidino,  Pantucci,  and  Kohlmann,  2010. 

8  “British  MP  Says  UK  Is  Recruitment  Ground,”  2009. 

9  Plon,  2010;  Ritter,  2010. 

10  See  Brady,  2009;  Kerbaj,  2010;  Rugman,  2009;  and  “Somalisk  Terrorist  Kom  fra  Danmark,”  2009. 
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well  documented  that  a  small  number  of  European  militants  have  also  participated  in  combat 
and  suicide  operations  in  Iraq.11  The  blowback  that  many  experts  anticipated  has  not  material¬ 
ized,  as  there  are  few  cases  of  veterans  of  the  Iraqi  conflict  who  have  engaged  in  terror  activities 
in  Europe.12  However,  neither  the  conflict  nor  the  presence  of  European  militants  has  com¬ 
pletely  waned.  Networks  recruiting  for  Iraq  are  still  very  much  operating  in  several  European 
countries,  and  the  flow  of  militants  back  and  forth  from  the  country  is  still  ongoing,  albeit 
with  a  significantly  lower  intensity  than  in  the  past.  In  November  2010,  for  example,  reports 
indicated  that  a  Swedish  national  of  Tunisian  descent  carried  out  a  suicide  attack  in  Mosul.13 

The  fifth  major  area  of  activities  of  al  Qaeda-affiliated  networks  worldwide,  the  Maghreb 
region,  is  a  slight  anomaly  from  the  point  of  view  of  linkage.  Al  Qaeda  in  the  Islamic  Maghreb, 
the  local  al  Qaeda  affiliate  and  the  descendant  of  a  long  tradition  of  jihadist  groups  in  the 
region,  has  suffered  several  operational  setbacks  over  the  last  few  years.  The  group  has  been 
forced  to  limit  its  activities  in  major  urban  areas  and  to  operate  mostly  in  the  Sahara  desert 
region  and  the  mountains  of  Kabylie,  focusing  predominantly  on  kidnapping  Westerners, 
smuggling,  and  occasional  skirmishes  with  Algerian,  Mauritanian,  and  Malian  security  forces. 
These  challenges  are  arguably  the  main  cause  of  AQIM’s  lack  of  attractiveness  for  European 
jihad  enthusiasts.  Few  non-North  Africans  travel  to  the  region  from  Europe  for  training, 
mostly  due  to  logistical  difficulties.  Nevertheless,  Europe-based  militants  linked  to  the  old 
North  African  networks  are  still  very  much  active  in  providing  logistical  support  to  the  group, 
and  many  of  them  often  travel  to  the  Maghreb  to  obtain  training  or  to  fight.14  Various  Euro¬ 
pean  governments — those  of  France  and  Spain  in  particular — consequently  consider  AQIM  a 
major  threat  to  their  internal  security,  fearing  it  might  concretize  its  increasingly  harsh  rhetoric 
against  them.  Somewhat  counterintuitively,  however,  there  are  few  indications  that  AQIM  has 
actually  activated  the  still-extensive  Europe-based  Algerian  networks  for  attacks.15 

Another  peculiar  feature  of  AQIM  is  its  virtually  exclusive  North  African  nature,  which 
is,  in  a  sense,  anachronistic.  Although  certain  divisions  along  ethnic  lines  still  exist  to  some 
degree  in  today’s  European  jihadist  networks,  the  networks  are  increasingly  diverse  and  multi¬ 
ethnic.  Composed  mostly  of  European-born  militants  and  formed  independently  from  estab¬ 
lished  groups  with  close  ties  to  any  non-European  country,  many  of  today’s  networks  include 
individuals  from  various  backgrounds.  No  better  examples  can  be  provided  to  showcase  this 
diversity  than  the  two  Hamburg-based  cells  that  formed  around  the  al  Quds  (later  Taiba) 
mosque  ten  years  apart.  If  the  late  1990s  cell  that  spawned  Mohammed  Atta  and  the  core 
9/11  hijackers  was  uniformly  Arab  (although  of  different  nationalities),  the  cell  that  coalesced 
in  the  late  2000s  and  then  traveled  to  Pakistan,  where  it  was  linked  to  the  October  2010  alert 
for  Mumbai-style  attacks  in  Europe,  included  ethnic  German  converts  and  first-  or  second- 
generation  immigrants  hailing  from  such  places  as  Afghanistan,  France,  Indonesia,  Iran, 


11  Hafez,  2007,  pp.  189-212;  Vidino,  2005,  pp.  215-290. 

12  Bergen  and  Reynolds,  2005. 

13  “Svensk  Sjalvmordsbombare  Dod  i  Irak,”  2010. 

14  Interviews  with  French  (Paris,  February  2010),  Italian  (Milan,  July  2010),  and  Spanish  (Madrid,  October  2009)  intel- 
ligence  officials. 

15  Interviews  with  British  (Washington,  D.C.,  January  2010)  and  French  (Paris,  February  2010)  officials. 
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Kazakhstan,  and  Russia.16  The  new  Hamburg  cell  is  not  the  exception  but  rather  increasingly 
the  rule  when  it  comes  to  ethnic  composition  of  European  networks. 

Adding  an  additional  layer  of  diversity  to  European  jihadist  networks  is  the  growing  pres¬ 
ence  of  converts  and  women.  European  converts  have  been  involved  in  jihadist  activities  for 
a  long  time,  and,  in  the  past,  some  of  them  had  even  risen  to  rather  senior  roles.17  This  trend 
is  continuing,  and  it  is  noteworthy  that,  in  some  plots,  converts  were  either  the  driving  force 
(e.g.,  Gelowicz  in  Operation  Alberich)  or  the  lone  attacker  (Andrew  Ibrahim,  Nick  Reilly,  and 
Nicholas  Roddis).  Women,  both  converts  and  native  Muslims,  are  more  of  a  novelty.  Although 
their  role  is  still  statistically  significantly  inferior  to  that  of  men  (Europol  puts  their  percentage 
among  arrestees  in  the  single  digits),  there  have  been  several  cases  in  which  women  have  played 
significant  roles  in  jihadist  networks.18  And  although  many  of  them  are  married  or  related  to 
militants  whose  activities  they  support,  others  operate  independently. 

This  phenomenon  is  highly  unusual  in  the  male-dominated  world  of  jihadist  groups. 
Dutch  authorities  began  observing  this  trend  in  the  mid-2000s  in  the  Hofstad  group  and  noted 
that,  “while  in  other  European  countries  radical  Muslim  women  keep  a  low  profile  and  play  at 
best  a  supporting  role,  their  role  in  local  networks  in  the  Netherlands  is  becoming  increasingly 
prominent.”19  Today  the  trend  is  visible  in  other  European  countries  as  well.  Though  it  is  dif¬ 
ficult  to  pinpoint  a  single  reason  for  this  enhancement  in  women’s  responsibilities,  it  might  be 
linked  to  the  pervasiveness  of  the  Internet.  The  virtual  world  is  a  great  equalizer,  a  place  where 
the  worth  of  cyber-jihadists  is  judged  more  by  the  quality  and  frequency  of  their  postings  than 
by  their  experience  or  gender.  In  this  gender-neutral  environment,  women  have  more  opportu¬ 
nities  to  emerge  and  play  a  role  equal  to  that  of  men.  In  this  respect,  Hofstad  and  other  con¬ 
temporary  jihadist  networks  seem  more  similar  to  “traditional”  indigenous  European  terrorist 
groups,  such  as  the  Italian  Red  Brigades  or  Germany’s  Baader  Meinhof  Gang,  in  which  women 
were  crucial,  than  to  their  counterparts  in  North  Africa  or  the  Middle  East.  The  enhanced  role 
of  women  may  therefore  be  another  indication  of  their  “Europeanness.” 

Finally,  it  should  be  noted  that  no  uniform  pattern  assessment  for  all  European  countries 
is  possible,  as  there  are  marked  differences  within  the  European  Union.20  France,  Germany, 
and  the  United  Kingdom  experience  widespread  jihadist  activities  on  their  territory  and  con¬ 
sider  the  risk  of  an  attack  against  them  very  elevated.  In  such  countries  as  Greece,  Portugal, 
and  most  Eastern  European  members  of  the  European  Union,  however,  the  situation  is  almost 
diametrically  opposed.  In  some  cases,  there  are  opposite  trajectories.  Dutch  authorities,  for 
example,  claim  to  have  recently  witnessed,  after  a  spike  in  2004-2005,  a  significant  decrease 
in  the  level  of  jihadist  activity  on  their  territory  and  claim  that  “overall,  local  jihadism  in  this 


16  Scheuermann  and  Ulrich,  2010,  pp.  24-26. 

17  A  few  notable  examples  include  Christian  Ganczarski,  Dhiren  Barot,  and  Pierre  Robert. 

18  Europol,  2007,  p.  20.  Particularly  noteworthy  in  this  regard  are  the  figures  of  El  Aroud  and  Choudhry.  The  former  is  the 
Brussels-based  widow  of  the  killer  of  Northern  Alliance  leader  Ahmed  Shah  Massoud.  El  Aroud  remarried  to  a  Tunisian 
militant  and  ran  an  Internet-based  network  that  recruited  militants  for  Afghanistan.  She  is  currently  serving  a  eight-year 
sentence  in  Belgium  for  “leading  a  terrorist  group  linked  with  al-Qaeda”  (“Belgium  Convicts  Eight  on  Terrorism  Charges,” 
2010).  Choudhry  is  the  King’s  College  student  who  admitted  radicalizing  online  by  watching  sermons  of  al  Awlaki  and  in 
May  2010  stabbed  Timms  to  punish  him  for  his  support  for  the  Iraq  War. 

^  Algemene  Inlichtingen-  en  Veiligheidsdienst,  2006,  p.  39. 

20  Europol,  2009,  p.  22. 
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country  has  more  or  less  stalled.”21  German  authorities,  on  the  other  hand,  have  monitored 
over  the  last  five  years  a  worrisome  surge  in  the  number  of  individuals  who  have  radicalized, 
obtained  training  in  Pakistan,  and  been  involved  in  terrorist  activities. 

Characteristics  of  jihadist  networks  also  differ  significantly  from  country  to  country  and, 
in  many  cases,  within  each  country  from  region  to  region  and  from  city  to  city.  In  most  Span¬ 
ish  regions,  for  example,  the  most-active  networks  are  North  African,  but  Catalan  authori¬ 
ties  are  equally  or  even  more  concerned  about  Pakistani  militants.22  Although  many  coun¬ 
tries  have  developed  various  pipelines  that  take  militants  to  more  than  one,  if  not  all,  of  the 
abovementioned  extra- European  “fields  of  jihad,”  there  are  diverse  patterns  in  terms  of  destina¬ 
tions  from  one  country  to  another.  Swedish  militants,  for  example,  have  tended  to  dispropor- 
tionally  travel  to  Somalia,  arguably  a  consequence  of  the  large  Somali  diaspora  community  in 
the  country.  German  militants,  on  the  other  hand,  have  established  a  pipeline  to  Pakistan.  As 
this  paper  relates,  in  most  countries,  networks  tend  to  be  multi-ethnic  and  composed  mostly 
of  second-generation  immigrants.  But,  in  countries  (like  Italy  and  Spain)  where  immigra¬ 
tion  is  a  more  recent  phenomenon  and  the  second  generation  of  locally  born  Muslims  is  only 
now  coming  of  age,  more-“traditional”  networks  with  closer  ties  to  one  country  are  still  more 
common. 


21  Algemene  Inlichtingen-  en  Veiligheidsdienst,  2010,  p.  6. 

22  Interview  with  Catalan  officials  (Barcelona,  October  2009). 
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Conclusion  and  Recommendations 


This  paper  sought  to  capture  some  of  the  most  recent  aspects  of  the  highly  complex  and  ever- 
shifting  dynamics  of  jihadist  networks  in  Europe.  As  it  relates,  the  current  phase  appears  to 
be  characterized  by  the  presence  of  diverse  networks  with  varying  degrees  of  affiliation  to 
al  Qaeda  and  several  of  its  affiliated  groups.  Although  many  of  them  have  little  more  than  an 
ideological  affiliation  to  AQAM,  an  increasing  number  of  European  homegrown  networks 
have  managed  to  establish  operational  linkages  with  it.  This  development  is  worrying  Euro¬ 
pean  and  American  authorities,  who  believe  that  the  deeper  the  operational  connectivity,  the 
more  severe  the  threat  these  networks  pose. 

The  fact  that  none  of  the  plots  against  Europe  over  the  last  five  years  has  been  successful  is 
due  partially  to  sheer  good  fortune  and  to  the  incompetence  of  most  plotters,  but  it  is  unques¬ 
tionably  a  testament  to  the  ability  of  police  forces  and  intelligence  agencies  throughout  Europe, 
the  United  States,  and  several  other  countries  that  have  often  cooperated  in  many  highly  com¬ 
plex  investigations.  In  the  case  of  hybrid  and  external  plots,  it  might  also  highlight  a  certain 
downgrading  of  AQAM’s  ability  to  successfully  plan  operations.  But  there  is  no  question  that 
the  European  counterterrorism  community  has  significantly  improved  its  understanding  of 
the  dynamics  of  jihadism  and  developed  better  tools  to  confront  it.  Nevertheless,  there  are 
obviously  areas  where  improvement  is  still  possible. 

As  this  paper  has  shown,  the  life  cycle  of  terrorist  networks,  in  Europe  as  in  other  regions, 
can  be  divided  between  the  radicalization  phase  and  the  mobilization  phase,  and  there  is 
room  for  authorities  to  do  more  to  tackle  both.  As  for  the  former,  it  is  imperative  that  Euro¬ 
pean  governments  increase  efforts  to  both  prevent  the  radicalization  of  new  militants  and 
encourage  already  radicalized  individuals  to  disengage  from  militant  networks.  Several  Euro¬ 
pean  governments  have  already  done  so,  investing  substantial  human,  financial,  and  political 
capital  in  more  or  less  extensive  counterradicalization  programs.  These  efforts  are  extremely 
controversial  and  have  encountered  significant  setbacks,  but  they  are  a  necessary  component 
of  a  comprehensive  counterterrorism  strategy.  Counterradicalization  programs  are  not  a  silver 
bullet  that  can  eliminate  radicalization,  but,  when  appropriately  designed  and  supported  by 
valid  research,  they  can  contribute  to  at  least  decreasing  the  number  of  individuals  embracing 
jihadist  ideology. 

There  are  also  ways  in  which  the  mobilization  phase — i.e.,  the  subsequent  stage  in  which 
a  radicalized  individual  or  cluster  decides  to  spring  into  action — can  be  more  effectively  coun¬ 
tered.  The  independent  networks’  lack  of  ties  to  international  groups  poses  a  unique  challenge. 
Although  it  prevents  them  from  acquiring  professional  terrorist  skills,  it  also  allows  them  to 
remain  undetected  by  law  enforcement  and  intelligence  agencies.  Community  policing,  close 
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monitoring  of  Internet  chat  rooms,  and  focus  on  so-called  radicalization  hot-spots  (such  as 
prisons  or  gateway  organizations)  are  tactics  that  can  improve  the  chances  of  detecting  them. 

As  for  those  individuals  and  clusters  that  do  establish  ties  to  AQAM,  a  strategy  based  on 
intercepting  travel  to  areas  where  AQAM  operates  and  on  disrupting  the  various  ways  in  which 
the  linkage  is  established  appears  to  be  apt  to  counter  the  phenomenon.  Indeed,  many  Euro¬ 
pean  law  enforcement  and  intelligence  agencies  have  long  been  working  on  these  parallel  tracks 
but  have  in  some  cases  lacked  the  necessary  legal  tools  or  resources.  As  for  travel,  enhanced 
cooperation  with  countries  where  European  jihadists  obtain  training,  combined  with  close 
monitoring  of  their  communications,  would  increase  the  chances  of  tracking  these  jihadists. 
Countries  that  do  not  consider  fighting  or  training  abroad  as  crimes  should  consider  reviewing 
their  legislation. 

This  paper  has  shown  that  there  are  various,  albeit  not  always  clear,  ways  in  which  the 
linkage  between  European  militants  and  AQAM  is  made.  Closer  monitoring  of  such  areas 
as  the  Internet,  prisons,  and  gateway  organizations  would,  carried  out  in  a  manner  compat¬ 
ible  with  the  respect  of  civil  liberties,  provide  a  better  insight  into  the  phenomenon  and  allow 
authorities  to  prevent  it  in  the  first  place.  The  paper  also  highlighted  the  importance  of  “jihad 
entrepreneurs”  in  “making  things  happen,”  connecting  European  militants  with  one  another 
and  with  AQAM.  Some  countries  have  allowed  some  of  these  individuals  to  operate  almost 
undisturbed  for  years.  When  this  has  happened  due  to  a  lack  of  legislative  tools  for  allowing 
law  enforcement  to  arrest  these  individuals,  lawmakers  should  work  on  expanding  the  legal 
definitions  of  recruitment  for  or  membership  in  a  terrorist  organization.  In  other  cases,  it  was 
a  conscious  decision  made  by  officials,  who  considered  it  more  useful  to  keep  these  individuals 
on  the  street,  as,  by  monitoring  their  activities,  authorities  could  uncover  their  web  of  contacts 
and  obtain  deeper  insights  into  jihadist  networks.  This  policy  has  led  to  some  remarkable  suc¬ 
cesses  but  is  also  highly  risky,  as  there  is  always  the  possibility  that  authorities  might  not  be 
able  to  monitor  all  activities.  The  policy’s  costs  and  benefits  should  therefore  be  weighed  on  a 
strict  case- by-case  basis. 
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